svcstealer | 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1

Analysis

max time kernel
57s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.7.exe
Size 54KB
Sample260825-gxt2jattdx
SHA256 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
MD5 3e88f1a1f48cb2a3556fdac9de4e8ef9
SHA1 dd839cd4619e104298bb2d823f4678504f148622
SHA512 fe55272561838a1cc3ed5d4145c7e4c7a1418d3c1bfd92f5bc8dfa29b1f7e7417ab6e3635ed8f249277c0be3a24be09bfa4f3065c81390624b0a65fdcc3fde0f
SSDEEP 1536:vtW4y8UFRx6GbgCSUMH18htq5Hk9Uepxc6kRdps:1W4yKBHmhg5HSUep3
TLSH
T15F43092916F64B65E8728279EAB44327D0F87C46BC70421F0773CE592F938C1A67CB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader execution svcstealer installer persistence spyware stealer

Malware Config

Signatures

Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/files/0x000d00000001c483-81.dat	family_svcstealer

Downloads MZ/PE file 3 IoCs

flow	pid	Process
6	5740	pan5i3cx.exe
6	5740	pan5i3cx.exe
7	5740	pan5i3cx.exe

Executes dropped EXE 14 IoCs

pid	Process
2932	bk4ny1dq.exe
4640	wlrmdr.exe
5740	pan5i3cx.exe
3788	svchost.exe
3924	pan5i3cx.exe
5344	taskhost.exe
5920	spoolsv.exe
3180	winlogon.exe
4088	spoolsv.exe
4140	lsass.exe
5112	ntsvcetc.exe
4196	inmi.exe
5592	inmi.exe
3044	6cch18ci.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\inmi.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Okwidu\\inmi.exe"	inmi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pan5i3cx.exe"	pan5i3cx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\spoolsv.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\ntsvcetc.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\spoolsv.exe"	spoolsv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5920 set thread context of 4404	5920	spoolsv.exe	59
PID 4088 set thread context of 4404	4088	spoolsv.exe	59

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7zG.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Windows Media Player\wmprph.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Internet Explorer\ieinstal.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Internet Explorer\ExtExport.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Windows Media Player\wmpshare.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Mail\wabmig.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Windows Media Player\setup_wm.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Windows Mail\wabmig.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Mail\wab.exe.tmp~	6cch18ci.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Windows Mail\wab.exe.tmp~	6cch18ci.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayer.exe.tmp~	6cch18ci.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1944	cmd.exe
4400	cmd.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x001000000001c472-472.dat	innosetup

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5232	2.7.exe
5232	2.7.exe
5920	spoolsv.exe
5920	spoolsv.exe
5920	spoolsv.exe
5920	spoolsv.exe
4088	spoolsv.exe
4088	spoolsv.exe
4088	spoolsv.exe
4088	spoolsv.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe
4140	lsass.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5428	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeSecurityPrivilege	5344	taskhost.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe
Token: SeCreatePagefilePrivilege	5428	explorer.exe
Token: SeShutdownPrivilege	5428	explorer.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 4404	5232	2.7.exe	59
PID 5232 wrote to memory of 4440	5232	2.7.exe	60
PID 5232 wrote to memory of 5084	5232	2.7.exe	64
PID 5232 wrote to memory of 5124	5232	2.7.exe	66
PID 5232 wrote to memory of 4220	5232	2.7.exe	80
PID 5232 wrote to memory of 5428	5232	2.7.exe	81
PID 5428 wrote to memory of 3156	5428	explorer.exe
PID 5232 wrote to memory of 2932	5232	2.7.exe	90
PID 5232 wrote to memory of 5740	5232	2.7.exe	92
PID 5428 wrote to memory of 1236	5428	explorer.exe
PID 5740 wrote to memory of 3788	5740	pan5i3cx.exe	94
PID 5740 wrote to memory of 5344	5740	pan5i3cx.exe	97
PID 5740 wrote to memory of 5920	5740	pan5i3cx.exe	98
PID 5428 wrote to memory of 5764	5428	explorer.exe
PID 5920 wrote to memory of 4404	5920	spoolsv.exe	59
PID 5740 wrote to memory of 3180	5740	pan5i3cx.exe	100
PID 4088 wrote to memory of 4404	4088	spoolsv.exe	59
PID 5740 wrote to memory of 4140	5740	pan5i3cx.exe	102
PID 5428 wrote to memory of 5460	5428	explorer.exe
PID 5344 wrote to memory of 4196	5344	taskhost.exe	106
PID 4196 wrote to memory of 5428	4196	inmi.exe	81
PID 5344 wrote to memory of 1944	5344	taskhost.exe	107
PID 5428 wrote to memory of 1792	5428	explorer.exe
PID 5232 wrote to memory of 3044	5232	2.7.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4404

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4440

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000268;000000000000026C;
1⤵
PID:5084

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5124

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4220
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Users\Admin\AppData\Local\Temp\2.7.exe
    "C:\Users\Admin\AppData\Local\Temp\2.7.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\bk4ny1dq.exe
      "C:\Users\Admin\AppData\Local\Temp\bk4ny1dq.exe"
      4⤵
      Executes dropped EXE
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\pan5i3cx.exe
      "C:\Users\Admin\AppData\Local\Temp\pan5i3cx.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
        5⤵
        Executes dropped EXE
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\taskhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5344
      - C:\Users\Admin\AppData\Roaming\Okwidu\inmi.exe
        
        "C:\Users\Admin\AppData\Roaming\Okwidu\inmi.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4196
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp773eac84.bat"
        6⤵
        Executes a command shell one-liner
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\spoolsv.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\winlogon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\winlogon.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\lsass.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\lsass.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4140
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        6⤵
        
        PID:8
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        6⤵
        
        PID:4736
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
        6⤵
        Executes a command shell one-liner
        
        PID:4400
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        7⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\8E52A47C6F884B0E807D.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8E52A47C6F884B0E807D.exe"
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\52E4B0AFBA1E45E089E3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\52E4B0AFBA1E45E089E3.exe"
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\is-HPLTJSER05.tmp\52E4B0AFBA1E45E089E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HPLTJSER05.tmp\52E4B0AFBA1E45E089E3.tmp" /SL5="$801E4,3709115,898560,C:\Users\Admin\AppData\Local\Temp\52E4B0AFBA1E45E089E3.exe"
        7⤵
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\6cch18ci.exe
      "C:\Users\Admin\AppData\Local\Temp\6cch18ci.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:3044

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Users\Admin\AppData\Local\Temp\pan5i3cx.exe
C:\Users\Admin\AppData\Local\Temp\pan5i3cx.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Admin\AppData\Roaming\ntsvcetc.exe
C:\Users\Admin\AppData\Roaming\ntsvcetc.exe
1⤵
- Executes dropped EXE
PID:5112

C:\Users\Admin\AppData\Roaming\Okwidu\inmi.exe
C:\Users\Admin\AppData\Roaming\Okwidu\inmi.exe
1⤵
- Executes dropped EXE
PID:5592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4LE7759X\2[1].exe
Size 212KB
SHA256 933e29899de1ff32f50bf687c38835e4b2d3de29934cb66386948b4befd8e1cb
MD5 c7171b652dca77633dbfe2cb13468055
SHA1 d25eccacd7fd3d84aabf1674ede1a9dc48d26dad
SHA512 081668c2025c9e186a1136a3415b0a4b1bd24e063a06e1f8b921a54e94ebedfcb7dbcc9e970e11a7b861c44283a0525dcd292ea471f1c41727a63a1e47470714
SSDEEP 3072:rS/umYftd1ew8WiRLNSQ94fyU8ImVhyCn26WOFz0lkAPxETc7rRxjytD:rCNEN8WENSQefycwhyK2loMxEOryN
TLSH
T138247E6BB5F45BB8F46FE235C9416A26D1B274091B31D38F22B48ED61F13332A22D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\96PJ9BGF\1[1].exe
Size 166KB
SHA256 fcbe9f2d0f07f6c40b258228148fb61e94f4dc59962f2fd4e3ed3051d90cfa3b
MD5 b61499aed9660923cde55a2cd3c88cc5
SHA1 8b1260a28e06c9c0c2d5ae48195aab24926901d3
SHA512 ee96b28539d8a6f75a0e3678420f8e764f26ec36a91c07e1b66421bbd2d723ed818a3ed7dd756a0d70aaac8a1c73960f67f1888ca9cfd99750a465af1ba8461d
SSDEEP 3072:btJ2fCsQiuzYJ8WreWgxgjIFafthDCMfCvOvHXrbl5STd:bwCszCYJ8OcgsaftB
TLSH
T1FDF37D4A73E510FDE1778139C9551A05F372782207209BAF07A047BA9F272E1AD3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SD49KLV2\2[1].exe
Size 2.3MB
SHA256 ea449d04d3a664eadbff4e054b1717ce36db82c40d27f179833cf15118de9e73
MD5 158a748771be8a06b496a410516d63a9
SHA1 a5926b439887f3f8d4f6b2686c5d4081673ff862
SHA512 491f1f18dc0f03261b5984255036e37c930cf368d7c11df4aead335a2feb8dcae366b575d4d2f3114d53e396568bdd1b940a20749ff562614dfb746d261b46bc
SSDEEP 49152:Lp2n/GN8i6JmPXcjxR2Z3Au/PJvTs6EBC:xCxRa/54
TLSH
T1FAB59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52E4B0AFBA1E45E089E3.exe

Path C:\Users\Admin\AppData\Local\Temp\52E4B0AFBA1E45E089E3.exe
Size 4.7MB
SHA256 ebbb9c3cc42ab9028336da01176293ede39a3f611829728d1a86e4b08d67263d
MD5 f6f2269e6397e76e64ce58b17fb149ce
SHA1 22865221e7a83a05a690d964fb89e05b8fdb0a14
SHA512 3128bb005357ab7df26354cad2e5774266f4f4fbe998332684d125c9f864c042393feba3e7af256c5252905d27c4a6ccaae328124e3cff22c655454416c98c17
SSDEEP 98304:VAX72A6JXaCRG20P7FCgSrEWjq7erB1RuVJFrl/hjq/TDo:U2AeXdH6FC5BOLFl5mPo
TLSH
T162360123F2CB613AE36E5A37D976B130453B6E106C138D0A96E4E46CCF35D603E3A656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cch18ci.exe

Path C:\Users\Admin\AppData\Local\Temp\6cch18ci.exe
Size 100KB
SHA256 4fb1aef4c32c9d2e694798fc695b2d81b9ec8a2978c932a4f6f75690e5252ea8
MD5 2c337b02206e1ef8b721f0d7c303761e
SHA1 c75a611aeb21b5bda1421093daa65141116dc863
SHA512 a804d26b98de7847a25fa2b90fd937996dbc83b0df8366d3319273187fb8d0ed9d4737914d7b5a135970d8cc885d470411e5e12fdb095f05c3f8d568652a0ba5
SSDEEP 1536:cOUIcNQDgbcKBiNSS0naCjXFq2SfbJ64MIIupJj4tzeJHQsWf3Nd09dlxzr:DUDogbKNIVF56gpIIupIee3nMvzr
TLSH
T163A36A9B73A530E8E6768238C8650A05EB77B8311621DF6F03A446861F273D19D3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8E52A47C6F884B0E807D.exe

Path C:\Users\Admin\AppData\Local\Temp\8E52A47C6F884B0E807D.exe
Size 166KB
SHA256 a564ca03842ac237973a6f07a1c25fb5a072d8fb7424b6ac8684888377391d9a
MD5 9f0ffb9820e62b6ef058a4cc72be5b4c
SHA1 211ff312c1ee2ef378ff2b5331bd1b7cb773af3e
SHA512 9fe5007c0d27139b43ee152264e304c2d5a8807ac8a5092344e8090eb8c093f6cd5571df498c70c7139b1d6596b6271b2e57e09358c7907a6977e6dacc347d47
SSDEEP 3072:td6/4CsQSODs98mIOWgxwlIFaKAzhDEWxrGvMvHXrb15STd:tJCsDSs98JswWaKAu8R
TLSH
T1D5F37C4A73E510FDE1378239C9551905F772782607209BAF07A04BBA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bk4ny1dq.exe

Path C:\Users\Admin\AppData\Local\Temp\bk4ny1dq.exe
Size 257KB
SHA256 0b594995b053042d2985260ee4092d9a46705e5f9fa4a482d476a5857714307d
MD5 b828e126346def192551a0917ca9264d
SHA1 c04fff6cb2652d6465ed3b3759225b9d8ba90aa9
SHA512 e649d29f0a8175d2d361ba8edd8f1a7fe1b18e8b2e47d8c7c4edf02e17a76af9b963e6d900c6d35ab0d142bbc5d675310b28762285ea133ee720dd40b3919efa
SSDEEP 3072:RpFyagHeoO59yMNTwIabzeUjymtes8gr6nwZcKtuMq7wORu3ee8/SKoY46PpdNKY:R2aAMNTwIc3jymtes8gOnwZq7wIohbY
TLSH
T1FE446B4A72A90CF8EDB7813CC9525A46E672B81607B0D6EF07A043675F276D09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-7G3GQ4RW90.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52E4B0AFBA1E45E089E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HPLTJSER05.tmp\52E4B0AFBA1E45E089E3.tmp
Size 4.2MB
SHA256 cd7f1a1f1505394737215ddccd4523ca51df6dc54c04b69d4a08fbccf894a01a
MD5 c2dc5f299822a831d4856d96ad0cb657
SHA1 cb2b1eb01c970f259665cf995aaec0ed9a145466
SHA512 cc63b18c3bc88d9781efb9ffd4ae31c8a181bc80ac6c56f75d8579a30b667fa73f9aa54e3e2ad2641c1f3d4acc5dcbbd9481bf129fd679f1dfc6de8e79e4ccb7
SSDEEP 49152:loPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lOo333Wo:lgw26xBij3QG+ddr9/OzGbRwr333l
TLSH
T1E6166C13F2C6653AD5671A3B883BB268583B7F303A178C477BE45D4C4E39A406D2A6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pan5i3cx.exe

Path C:\Users\Admin\AppData\Local\Temp\pan5i3cx.exe
Size 120KB
SHA256 32b173a4a2bbc767d93bd6c645170479f1d3eb27f9ae5b47c9260ec31f739bf7
MD5 842b09509ab819c1e7edecd41d4c301b
SHA1 38efdf62dfb36898c662bb912c0e76d79e8836bf
SHA512 aa3ecddb8af12b6970fccd5106406f86bf55656193b0683da17b23ce47d3abe4cd7e64c4377206664709678f338c338d5e0ba44b193cb38b34113ea33ec29e6a
SSDEEP 1536:HlyFwDCtFe20zYrnw5p15i8VOTypRxn2KXdTY+sWLdP9dldGOIJ:HlyFPtv0kTwDxUepRx2KG6vbGOI
TLSH
T1C2C36B1777A530F8E17B823589215A16E7B378310B758B6F03A4426A6F277D09E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 54KB
SHA256 985ead812b8b99573d2567169d73968a3754b4fbea16447bea2ac878974e6110
MD5 26b59bc7336133a5e2f3c696584a9cb9
SHA1 bc2f26426ab52186449688d6e56326a4ef65de27
SHA512 6292a2c4e44449cd7f02aebb2b3f3f6c6b9425c851b75946575004a84b075ab9a26dd2cd705b5dbd41d9eaf672217ed7c0e611b6c99bd0190e3a001986085b36
SSDEEP 1536:KP2AunwYLdkqx4sOLsWz129UXMRRpUafq8LECJu:znXfqLsWJ2LRJfq8Lbu
TLSH
T1ED43082653A213B9D9EAC636C9F4533BF1F07542BA26931F0378F6281B73742751CAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp773eac84.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp773eac84.bat
Size 195B
SHA256 dea95cf9e750c3afde174bb661369b762a5a694c92f6063ca4adbe0a29ba76a5
MD5 5e4369d417fd42442429474c81adcae9
SHA1 9ae78b19f0fd803aa6639a15db4a8910b43362a0
SHA512 57d36dd49c39529a21387e73530e4e9281ec3cc9ed04aeaad61147a84ee103a5e9494f7eca509b6c7e331c5ca7fb899b4004a935c5078d00f84cd1763c47e60c
TLSH
T167D0128581C6CB59180D55A706E9A1CCE1A908983FCA7B585621C45DA2A241DF6C7742
MD5 SHA1 SHA512 TLSH

Submit Download

wlrmdr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
Size 54KB
SHA256 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
MD5 3e88f1a1f48cb2a3556fdac9de4e8ef9
SHA1 dd839cd4619e104298bb2d823f4678504f148622
SHA512 fe55272561838a1cc3ed5d4145c7e4c7a1418d3c1bfd92f5bc8dfa29b1f7e7417ab6e3635ed8f249277c0be3a24be09bfa4f3065c81390624b0a65fdcc3fde0f
SSDEEP 1536:vtW4y8UFRx6GbgCSUMH18htq5Hk9Uepxc6kRdps:1W4yKBHmhg5HSUep3
TLSH
T15F43092916F64B65E8728279EAB44327D0F87C46BC70421F0773CE592F938C1A67CB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inmi.exe

Path C:\Users\Admin\AppData\Roaming\Okwidu\inmi.exe
Size 212KB
SHA256 4910bc4c240dc1012ec65b297250772fd63ec0db6f849669c5d79c5ab23ccb50
MD5 850ccdef3a991e1ac9accfb658d1c055
SHA1 b94bddef8e575afa7ec7a58ac9daec96f0ee2cbf
SHA512 ae3b8ea9c20df631fd05c1222aef5f5075cb9d48afdebc1e9c4ed18f116da173c94c66539e34c5b2f23b96774907f0110cccdddd93da613a358582132144a917
SSDEEP 3072:rS/umYftd1ew8WiRLNSQ94fyU8ImVhyCn26WOFz0lkAPxETc7rRxjytu:rCNEN8WENSQefycwhyK2loMxEOryY
TLSH
T1F9247E6BB5E45BB8F46FE235C9416A26D1B274091B31D38F22B48ED61F13332A22D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4140-158-0x0000019B2DBC0000-0x0000019B2DD8A000-memory.dmp

Download

memory/4196-169-0x00000000005A0000-0x00000000005A8000-memory.dmp

Download

memory/4196-182-0x0000000002310000-0x00000000023B3000-memory.dmp

Download

memory/4196-166-0x0000000000F10000-0x0000000000FC2000-memory.dmp

Download

memory/4196-167-0x0000000000FD0000-0x000000000102D000-memory.dmp

Download

memory/4196-173-0x0000000000600000-0x000000000060D000-memory.dmp

Download

memory/4196-162-0x0000000000490000-0x0000000000557000-memory.dmp

Download

memory/4196-175-0x0000000001960000-0x000000000197A000-memory.dmp

Download

memory/4196-176-0x0000000001980000-0x000000000198B000-memory.dmp

Download

memory/4196-177-0x0000000001730000-0x0000000001757000-memory.dmp

Download

memory/4196-164-0x0000000000BA0000-0x0000000000C3D000-memory.dmp

Download

memory/4196-165-0x0000000000D40000-0x0000000000F03000-memory.dmp

Download

memory/4196-179-0x0000000001FE0000-0x0000000002089000-memory.dmp

Download

memory/4196-180-0x0000000002140000-0x00000000021E7000-memory.dmp

Download

memory/4196-163-0x0000000000710000-0x0000000000AB1000-memory.dmp

Download

memory/4196-171-0x00000000018E0000-0x0000000001954000-memory.dmp

Download

memory/4196-178-0x0000000001790000-0x00000000017BA000-memory.dmp

Download

memory/4404-66-0x00000273E5B20000-0x00000273E5B52000-memory.dmp

Download

memory/4404-0-0x00000273E1F60000-0x00000273E1F62000-memory.dmp

Download

memory/5084-14-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/5344-102-0x0000000000B30000-0x0000000000BCD000-memory.dmp

Download

memory/5344-133-0x00000000046B0000-0x0000000004749000-memory.dmp

Download

memory/5344-138-0x0000000005060000-0x0000000005095000-memory.dmp

Download

memory/5344-137-0x0000000004F80000-0x0000000005053000-memory.dmp

Download

memory/5344-126-0x00000000027A0000-0x00000000028C1000-memory.dmp

Download

memory/5344-124-0x00000000023D0000-0x000000000274C000-memory.dmp

Download

memory/5344-132-0x0000000004270000-0x000000000427C000-memory.dmp

Download

memory/5344-131-0x0000000004230000-0x0000000004268000-memory.dmp

Download

memory/5344-130-0x0000000004130000-0x000000000414C000-memory.dmp

Download

memory/5344-129-0x0000000002B10000-0x0000000002B3F000-memory.dmp

Download

memory/5344-128-0x00000000028F0000-0x00000000028FD000-memory.dmp

Download

memory/5344-127-0x00000000028D0000-0x00000000028EB000-memory.dmp

Download

memory/5344-123-0x0000000002280000-0x00000000023CB000-memory.dmp

Download

memory/5344-122-0x00000000021D0000-0x0000000002273000-memory.dmp

Download

memory/5344-125-0x0000000002750000-0x0000000002798000-memory.dmp

Download

memory/5344-120-0x0000000002000000-0x00000000020A7000-memory.dmp

Download

memory/5344-119-0x0000000001F50000-0x0000000001FF9000-memory.dmp

Download

memory/5344-113-0x0000000001C20000-0x0000000001EA3000-memory.dmp

Download

memory/5344-117-0x0000000001BB0000-0x0000000001BD7000-memory.dmp

Download

memory/5344-116-0x0000000001EB0000-0x0000000001F24000-memory.dmp

Download

memory/5344-115-0x0000000001B90000-0x0000000001B9B000-memory.dmp

Download

memory/5344-114-0x0000000001B70000-0x0000000001B8A000-memory.dmp

Download

memory/5344-100-0x0000000000490000-0x0000000000557000-memory.dmp

Download

memory/5344-136-0x0000000004750000-0x0000000004F7A000-memory.dmp

Download

memory/5344-134-0x0000000004280000-0x00000000042A6000-memory.dmp

Download

memory/5344-121-0x00000000020B0000-0x00000000021C6000-memory.dmp

Download

memory/5344-118-0x0000000001BE0000-0x0000000001C0A000-memory.dmp

Download

memory/5344-110-0x0000000001470000-0x0000000001B66000-memory.dmp

Download

memory/5344-106-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Download

memory/5344-104-0x0000000000EF0000-0x0000000000FA2000-memory.dmp

Download

memory/5344-109-0x00000000012B0000-0x00000000012BD000-memory.dmp

Download

memory/5344-108-0x00000000012F0000-0x0000000001466000-memory.dmp

Download

memory/5344-107-0x0000000001110000-0x00000000012A9000-memory.dmp

Download

memory/5344-103-0x0000000000CD0000-0x0000000000E93000-memory.dmp

Download

memory/5344-105-0x0000000000FB0000-0x000000000100D000-memory.dmp

Download

memory/5344-101-0x0000000000660000-0x0000000000A01000-memory.dmp

Download

memory/5428-139-0x0000000007160000-0x0000000007161000-memory.dmp

Download

memory/5428-96-0x0000000006460000-0x00000000064A1000-memory.dmp

Download

memory/5428-97-0x0000000006460000-0x00000000064A1000-memory.dmp

Download

memory/5428-98-0x0000000006460000-0x00000000064A1000-memory.dmp

Download

memory/5428-95-0x0000000006460000-0x00000000064A1000-memory.dmp

Download

memory/5428-86-0x0000000003D70000-0x0000000003D71000-memory.dmp

Download

memory/5428-65-0x0000000003D80000-0x0000000003D81000-memory.dmp

Download

memory/5428-38-0x00000000015B0000-0x00000000015B1000-memory.dmp

Download

memory/5428-24-0x00000000015D0000-0x00000000015D1000-memory.dmp

Download