9ecb69ee444940cc0b74d0ad42dae28d2b242c6487dc55be07b9d9b2bc448a13

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f3efe7ec3951b20a83221e09f2e3d008_icedid_vidar.exe
Size 689KB
Sample260821-cl72sshb56
SHA256 9ecb69ee444940cc0b74d0ad42dae28d2b242c6487dc55be07b9d9b2bc448a13
MD5 f3efe7ec3951b20a83221e09f2e3d008
SHA1 fb51351086eea94d904e498dc6ba0f58a771f8ab
SHA512 7c24bde8075f590476a8c6f4f1875214ba96ceff31687ebda48138e71c592bb75fda39e44a29b1cbb1b9bf33588954076b94856040c587678e7d258dcea98754
SSDEEP 12288:vzaqfSvLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:WvILD8F8tEi5klhtKrLlzb6cd
TLSH
T1A6E4125336A073E8E659617889342655E372B4700E71DBAF4B79829B1F3F2E04D2AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
2548	alg.exe
4236	elevation_service.exe
2528	elevation_service.exe
5436	maintenanceservice.exe
4836	OSE.EXE
2756	GameInputSvc.exe
5528	GameInputSvc.exe
5964	msdtc.exe
3540	PerceptionSimulationService.exe
4264	perfhost.exe
5296	ReFsDedupSvc.exe
1828	locator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_f3efe7ec3951b20a83221e09f2e3d008_icedid_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b45334ad209659e8.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_f3efe7ec3951b20a83221e09f2e3d008_icedid_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5528	GameInputSvc.exe
5528	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4808	2026-08-20_f3efe7ec3951b20a83221e09f2e3d008_icedid_vidar.exe
Token: SeDebugPrivilege	2548	alg.exe
Token: SeDebugPrivilege	2548	alg.exe
Token: SeTakeOwnershipPrivilege	4236	elevation_service.exe
Token: SeTcbPrivilege	2756	GameInputSvc.exe
Token: SeBackupPrivilege	5296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5296	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 5528	2756	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f3efe7ec3951b20a83221e09f2e3d008_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f3efe7ec3951b20a83221e09f2e3d008_icedid_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2528

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5436

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4836

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5528

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3540

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4264

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5296

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1828

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f5b65bc22f57fea797edcc94b7805a6ef01ba2ce5c4d86c0b709c63f88dc1c97
MD5 c021514034b538bdb90e762a3f297472
SHA1 93d8ed926ca9956916fd69e7b38dcb25c497ee65
SHA512 8dd33b8ff83d3bd1c268e61597e786a4c50637cb6fce60b9b8cb04cf813fef1b0f105557928c0cda42555712a48a0c3240d791d1367c64d1fcd478bbe7169026
SSDEEP 49152:Ib+632BuPkFKRrdE6oh7stBhuXjfS4LWxneIfHSa9fla2:i3q6gjBUflh
TLSH
T106D59D03F2D901E8E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 37961b3d75044f976afa9b23ab479d81dbf5265a0a551777a221aca7e9a2a2c2
MD5 539df396ba03d928910e466d0bde19da
SHA1 e4b22d4020f340e408149d18a68b55119e095de4
SHA512 294e3a4b2a4de099883c1fada6db31a557d3532eb27a400e718a18275b951bd32e52e641911711f6e42d948a9d55b09a1a5e45f80e9355e9e4e7e68c9b034565
SSDEEP 24576:GXYKDtczAbILD8F8tEi5klhtKrLlzb6cd:6tcCIfHSa9fla2
TLSH
T1AE05F12977A009F8ED67817CCC719511E773B8814BA0E79B03A4956A1F372E84E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 afe6e3d884faf7e5921a807d7ec91fee76ac192a50ee14d08350d2942d83b4b7
MD5 5866f9506587c9f513e80e35670b3709
SHA1 6bb6bf854ea127bc6b384f248f17a10ae76fb8f2
SHA512 47cbda575ba3117888cbf53ed55c4bb4727188427dc575d3f70dd78287daeeb89e128c0f761146021771ba74d0fca97057ca40b5440db3a2aea89859cfbb3f7a
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+C6Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6l:UwusOWxILD8F8tEi5klhtKrLlzb6c
TLSH
T19505F14637A40CF8EA665138855B9132F7F2B8412E65CB2F4770C65B6F3B2616D2EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f5b4db06cf56a5e5684bb139c7b654fbd2ac09705c4d0504bb2b6970ac551a3d
MD5 1c3ed0ceed7a64e5e40be66803ac29df
SHA1 dec7f25be3611a9e984dd29ffdcdb7b3c9d636a5
SHA512 36e3def2949d09087bd4257ca0a190e5d86b5ebc5cf61b9492cba864bda61d905be352f10ccb057d7145471e95b37bcb386a5c7932116386636eabd02dc1baf9
SSDEEP 49152:0B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glpIfHSa9fla2:uu6JmTxd2dgflh
TLSH
T17CD59D13F1D901E8D05ED478974AA233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 f0fe1b4b4e9557bbe1d98dd010b298792ac46018ff10c707569e813e0695250c
MD5 b0009e9b71966fb95c3aa05137d9e4ba
SHA1 437964285a0ac080a2cd6e5400cc85afab72e953
SHA512 7cd47f2f8154d03c50caeb63a8667935a30f477e36d835a5e8395bd31f2e9559978e53b0becfe6e56b888045f3c4b70bb860d8b73fde7a19235168afff900e3f
SSDEEP 12288:Kl7oLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:ukILD8F8tEi5klhtKrLlzb6cd
TLSH
T19FD423222A608704FE5C31B4093C3171636AF4D05EA9C5BBDB6E91CE2E3E1F54926E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 001be5e64668865b031a8f0b289901f5ec05cb1ae7e2ec2f0168c301f505157c
MD5 f01df1916aff59edc1a5a238b512870a
SHA1 6c6c2431941ca20220d39ae6854cc64dda191056
SHA512 6592d52bcab22502618592d33611629516cd25ca6650cb84d8b5ec139c6e7d25485506a92882629fcf202f4e43927f496d8281244815cfdfa12c8d73ab6795a6
SSDEEP 12288:+ZG0Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:eGgILD8F8tEi5klhtKrLlzb6cd
TLSH
T1D2E4122A39B16284DE395178483C31A2B7B174901F6596FF8BE9D0BA5F3E1F01239D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 a28b081e72ac3355ef7ff714e2079f14eb7f38f9850935f1704bd4e0c2331e2f
MD5 e1de777f06500333f49fde04d65d1e45
SHA1 7f7fd130ab09935e66a8393d136aa94016a55e44
SHA512 43d12e131c71c24d923b9497fbccbcc6ba8a6fa40c40dd138428f6b9742a3471016c0ec65ef243dbb41c77d0727345f32afd2bc443a50b25aca397c5d7b27907
SSDEEP 12288:gXLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:gtILD8F8tEi5klhtKrLlzb6cd
TLSH
T121D4236229208744EF4831B4093C31A16765B4C05FEAD6FBDB7EE1DA1A3E1F5013ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 20c53fa1da54923df598e42a5897f3dde746fe4dd37818ce62c01d3137877152
MD5 241b0d79a86f69a5b6cfe09d6a42a7be
SHA1 219327dbe47927cd11ef9e9a47e3b8b63a79cbb2
SHA512 b04238b6da07062154e0797624f384a1c4a1aebbae32c2017e4cf2155d9ddfa1cd9f8def77cc43fc236f5c8d8f4cde283f276871a971389492bb69353bf352a3
SSDEEP 12288:EHvUrBFrEjwaQhLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:EPUr+NQPILD8F8tEi5klhtKrLlzb6cd
TLSH
T1B905F12F26A818E4E67AA17C89555719F771B4520712D2DF03E1817E1F37AE8AC3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 f8f12120dbc516ef85b11ed62d46b2de980f0ba88f859291c21cffb245fb2b9b
MD5 687c022372f9802e9b6a0e41f4fcad62
SHA1 e5b7e3bdf34a17443e318a47b103152a192bd57f
SHA512 82fd462a880ee31e1b25555f602fb7d869c8c5358dd0092f6cf06bcf16eb655e8207fc6e1acdf45f0b7e51ef6a628c8c9f4b6eacf8b75638edb74abe830b847a
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsIfHSa9fla2:bG05lO43bIflh
TLSH
T183D5CF6A62EC11F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 26cdf25986ede1bd95efacfc3e623bda49ca6e355413f1ff40f6026e82a45c6b
MD5 a6c6291658e6bd347d42909baedd9c67
SHA1 4118f7956774808bcc5499504931d5bcf419ff28
SHA512 192b6bdd25435372fe05400db8f2f83ec2254930fc6d6d09ee63d2eec3b13986cb84d176e51e98d86e633ea8330387514c56e9dd6c586924050eb63a8f4cc07f
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkWILD8F8tEi5klhtKrLlzb6cd:BNc/zEOVHFBIfHSa9fla2
TLSH
T1A3858B1622E901E4F5BBE1BE897B9546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 4adf6e8afb513b2e7e6b3156090ec1ac96088832b5ddcd2d34a445b07014035a
MD5 8e0cd52420543097d7a8c08be7e6ef8b
SHA1 956f17ae4d835cf842a911b9c94fe97a3549eaf3
SHA512 3f8746a21d4dc89dab66329f0d0739b2c0dec9f4c3989dcec28711257b3df053e9ee35d0a7afd394d1d61e0d184563fb7be87467ee3fff74ffa29e4b59081a6f
SSDEEP 12288:n1Hck6j5ZI7gMLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:T6DIdILD8F8tEi5klhtKrLlzb6cd
TLSH
T147F4011D337611F5D16BA03D85520112E3B2B0A08B629AEF47A8C0BE5F77EE8B53DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 82defe8a5dc952c33bd3f2deeb0023ceca09d722f9e12968b7442b92cb0028b8
MD5 d1631a105264fbcafca220f752e8682e
SHA1 0585da7b477a6fb60e5dc577ec8f9a4159c40706
SHA512 db7ae817b090117d5e67e91212458fe7a35e8dc3829218e08e3e35acf2f755776759785c73b0d1edb814844b4c567c497cd6d40984e33b1ac52e78e13dd68bd3
SSDEEP 12288:6G6kyrLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:TtyxILD8F8tEi5klhtKrLlzb6cd
TLSH
T1A9F4120127A09284EE6921788A3952A09B75BC505F61C3EF97A1E27F2F3E3F05835F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1828-291-0x000001DE4DB90000-0x000001DE4DBF6000-memory.dmp

Download

memory/1828-292-0x000001DE4DB90000-0x000001DE4DBF6000-memory.dmp

Download

memory/1828-290-0x00007FF699080000-0x00007FF69912D000-memory.dmp

Download

memory/2528-37-0x0000018545E10000-0x0000018545E76000-memory.dmp

Download

memory/2528-34-0x0000018545B60000-0x0000018545CEA000-memory.dmp

Download

memory/2528-35-0x0000018545E10000-0x0000018545E76000-memory.dmp

Download

memory/2528-36-0x0000018545E10000-0x0000018545E76000-memory.dmp

Download

memory/2548-11-0x00007FF63C5D0000-0x00007FF63C6F2000-memory.dmp

Download

memory/2548-12-0x000002BE682C0000-0x000002BE68326000-memory.dmp

Download

memory/2548-43-0x00007FF63C5D0000-0x00007FF63C6F2000-memory.dmp

Download

memory/2548-14-0x000002BE682C0000-0x000002BE68326000-memory.dmp

Download

memory/2548-13-0x000002BE682C0000-0x000002BE68326000-memory.dmp

Download

memory/2756-234-0x0000026264CB0000-0x0000026264D16000-memory.dmp

Download

memory/2756-233-0x0000026264CB0000-0x0000026264D16000-memory.dmp

Download

memory/2756-232-0x00007FF6BD860000-0x00007FF6BD928000-memory.dmp

Download

memory/3540-264-0x0000022D16900000-0x0000022D16966000-memory.dmp

Download

memory/3540-261-0x00007FF6F1360000-0x00007FF6F14A9000-memory.dmp

Download

memory/3540-263-0x0000022D16900000-0x0000022D16966000-memory.dmp

Download

memory/4236-28-0x00000235E57F0000-0x00000235E5856000-memory.dmp

Download

memory/4236-27-0x00000235E57F0000-0x00000235E5856000-memory.dmp

Download

memory/4236-25-0x00000235E5880000-0x00000235E5A0A000-memory.dmp

Download

memory/4236-26-0x00000235E57F0000-0x00000235E5856000-memory.dmp

Download

memory/4264-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4264-276-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/4264-271-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/4596-299-0x0000023F04B30000-0x0000023F04B96000-memory.dmp

Download

memory/4596-300-0x0000023F04B30000-0x0000023F04B96000-memory.dmp

Download

memory/4596-304-0x00007FF7C3760000-0x00007FF7C3B76000-memory.dmp

Download

memory/4808-1-0x0000024A4ABB0000-0x0000024A4AC16000-memory.dmp

Download

memory/4808-22-0x00007FF794BB0000-0x00007FF794C9A000-memory.dmp

Download

memory/4808-19-0x0000024A4ABB0000-0x0000024A4AC16000-memory.dmp

Download

memory/4808-0-0x00007FF794BB0000-0x00007FF794C9A000-memory.dmp

Download

memory/4808-3-0x0000024A4ABB0000-0x0000024A4AC16000-memory.dmp

Download

memory/4836-57-0x0000026741BB0000-0x0000026741C16000-memory.dmp

Download

memory/4836-58-0x0000026741BB0000-0x0000026741C16000-memory.dmp

Download

memory/4836-56-0x0000026741900000-0x0000026741A8A000-memory.dmp

Download

memory/5296-282-0x00007FF793D60000-0x00007FF7944A3000-memory.dmp

Download

memory/5296-283-0x0000021B6EB40000-0x0000021B6EBA6000-memory.dmp

Download

memory/5296-285-0x0000021B6EB40000-0x0000021B6EBA6000-memory.dmp

Download

memory/5436-45-0x00000229695D0000-0x0000022969636000-memory.dmp

Download

memory/5436-44-0x00007FF644430000-0x00007FF644598000-memory.dmp

Download

memory/5436-46-0x00000229695D0000-0x0000022969636000-memory.dmp

Download

memory/5436-51-0x00000229695D0000-0x0000022969636000-memory.dmp

Download

memory/5436-53-0x00007FF644430000-0x00007FF644598000-memory.dmp

Download

memory/5528-243-0x0000021D25240000-0x0000021D252A6000-memory.dmp

Download

memory/5528-242-0x0000021D25240000-0x0000021D252A6000-memory.dmp

Download

memory/5528-241-0x00007FF6BD860000-0x00007FF6BD928000-memory.dmp

Download

memory/5964-250-0x00000219117E0000-0x0000021911846000-memory.dmp

Download

memory/5964-246-0x00007FF7E0540000-0x00007FF7E0659000-memory.dmp

Download

memory/5964-251-0x00000219117E0000-0x0000021911846000-memory.dmp

Download