salatstealer | 7145c0a4af5f6921024a522a14bbd7c0275e0a78763995eee8c720ce5495f6d9

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nonagon installer.exe
Size 81.5MB
Sample260930-fehecayalf
SHA256 7145c0a4af5f6921024a522a14bbd7c0275e0a78763995eee8c720ce5495f6d9
MD5 deac8b05c5649f28d7f05f0794e64595
SHA1 0539f9a3d522ebd39584a7d336a0f7ef27623327
SHA512 a28b6f118121c216324fbd9f427c1e677cd683f5d0a9d8a8365e4b91c103f302924c84c0ea7516532f1ffa7e9325150638b1420f36f17829dbc126dfe7499ef0
SSDEEP 786432:YeGZqeV5OtsF5EyA7H9xiDr7MR/ZFLMKkxjR1VPhk:9GbNydx44Z1cjNhk
TLSH
T177189D25A7E40A1AD93FC1BDC6718266D6F0F8C5031186CF2544EB993F63BC46DBA362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 32 IoCs

resource	yara_rule
behavioral2/memory/4492-10-0x0000000000400000-0x0000000001056000-memory.dmp	family_salatstealer
behavioral2/memory/4332-11-0x0000000000C10000-0x0000000001865000-memory.dmp	family_salatstealer
behavioral2/memory/4332-12-0x0000000000C10000-0x0000000001865000-memory.dmp	family_salatstealer
behavioral2/memory/4492-13-0x0000000000400000-0x0000000001056000-memory.dmp	family_salatstealer
behavioral2/memory/4332-14-0x0000000000C10000-0x0000000001865000-memory.dmp	family_salatstealer
behavioral2/memory/4492-15-0x0000000000400000-0x0000000001056000-memory.dmp	family_salatstealer
behavioral2/memory/4332-16-0x0000000000C10000-0x0000000001865000-memory.dmp	family_salatstealer
behavioral2/memory/4492-22-0x0000000000400000-0x0000000001056000-memory.dmp	family_salatstealer
behavioral2/memory/4332-25-0x0000000000C10000-0x0000000001865000-memory.dmp	family_salatstealer
behavioral2/memory/4332-33-0x0000000000C10000-0x0000000001865000-memory.dmp	family_salatstealer
behavioral2/memory/460-35-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/460-36-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-37-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer
behavioral2/memory/460-38-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-39-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer
behavioral2/memory/460-41-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-42-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer
behavioral2/memory/460-43-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-54-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer
behavioral2/memory/6120-76-0x0000000000570000-0x00000000011C5000-memory.dmp	family_salatstealer
behavioral2/memory/460-88-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-91-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer
behavioral2/memory/460-92-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-93-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer
behavioral2/memory/460-94-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-95-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer
behavioral2/memory/460-96-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-97-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer
behavioral2/memory/460-98-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-99-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer
behavioral2/memory/460-100-0x00000000009C0000-0x0000000001616000-memory.dmp	family_salatstealer
behavioral2/memory/1696-101-0x0000000000C80000-0x00000000018D5000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
51	5724	powershell.exe
52	5724	powershell.exe
53	5724	powershell.exe
54	5724	powershell.exe
55	5724	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
4492	payload.exe
4332	windivert.exe
460	WUDFHost.exe
1696	SecurityHealthSystray.exe
6120	SecurityHealthSystray.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001100000001c448-2.dat	upx
behavioral2/memory/4492-4-0x0000000000400000-0x0000000001056000-memory.dmp	upx
behavioral2/files/0x001900000001c468-7.dat	upx
behavioral2/memory/4332-9-0x0000000000C10000-0x0000000001865000-memory.dmp	upx
behavioral2/memory/4492-10-0x0000000000400000-0x0000000001056000-memory.dmp	upx
behavioral2/memory/4332-11-0x0000000000C10000-0x0000000001865000-memory.dmp	upx
behavioral2/memory/4332-12-0x0000000000C10000-0x0000000001865000-memory.dmp	upx
behavioral2/memory/4492-13-0x0000000000400000-0x0000000001056000-memory.dmp	upx
behavioral2/memory/4332-14-0x0000000000C10000-0x0000000001865000-memory.dmp	upx
behavioral2/memory/4492-15-0x0000000000400000-0x0000000001056000-memory.dmp	upx
behavioral2/memory/4332-16-0x0000000000C10000-0x0000000001865000-memory.dmp	upx
behavioral2/memory/460-24-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/4492-22-0x0000000000400000-0x0000000001056000-memory.dmp	upx
behavioral2/memory/4332-25-0x0000000000C10000-0x0000000001865000-memory.dmp	upx
behavioral2/memory/1696-34-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/4332-33-0x0000000000C10000-0x0000000001865000-memory.dmp	upx
behavioral2/memory/460-35-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/460-36-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-37-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/460-38-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-39-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/460-41-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-42-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/460-43-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-54-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/6120-73-0x0000000000570000-0x00000000011C5000-memory.dmp	upx
behavioral2/memory/6120-76-0x0000000000570000-0x00000000011C5000-memory.dmp	upx
behavioral2/memory/460-88-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-91-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/460-92-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-93-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/460-94-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-95-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/460-96-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-97-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/460-98-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-99-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx
behavioral2/memory/460-100-0x00000000009C0000-0x0000000001616000-memory.dmp	upx
behavioral2/memory/1696-101-0x0000000000C80000-0x00000000018D5000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\6ffdacb4-c7ff-149a-5109-6eeaedc7b4c7	payload.exe
File opened for modification	C:\Program Files (x86)\Adobe\WUDFHost.exe	payload.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\23a7a53a-c99f-84d5-185f-a70c395b3ac9	windivert.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\fontdrvhost.exe	windivert.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthSystray.exe	SecurityHealthSystray.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 9 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	payload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WUDFHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthSystray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthSystray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthSystray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	payload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windivert.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windivert.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WUDFHost.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityHealthSystray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityHealthSystray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windivert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4492	payload.exe
4492	payload.exe
4332	windivert.exe
4332	windivert.exe
4492	payload.exe
4492	payload.exe
4332	windivert.exe
4332	windivert.exe
460	WUDFHost.exe
460	WUDFHost.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
5724	powershell.exe
5724	powershell.exe
4328	powershell.exe
4328	powershell.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe
1696	SecurityHealthSystray.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	nonagon installer.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeIncreaseQuotaPrivilege	5724	powershell.exe
Token: SeSecurityPrivilege	5724	powershell.exe
Token: SeTakeOwnershipPrivilege	5724	powershell.exe
Token: SeLoadDriverPrivilege	5724	powershell.exe
Token: SeSystemProfilePrivilege	5724	powershell.exe
Token: SeSystemtimePrivilege	5724	powershell.exe
Token: SeProfSingleProcessPrivilege	5724	powershell.exe
Token: SeIncBasePriorityPrivilege	5724	powershell.exe
Token: SeCreatePagefilePrivilege	5724	powershell.exe
Token: SeBackupPrivilege	5724	powershell.exe
Token: SeRestorePrivilege	5724	powershell.exe
Token: SeShutdownPrivilege	5724	powershell.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeSystemEnvironmentPrivilege	5724	powershell.exe
Token: SeRemoteShutdownPrivilege	5724	powershell.exe
Token: SeUndockPrivilege	5724	powershell.exe
Token: SeManageVolumePrivilege	5724	powershell.exe
Token: 33	5724	powershell.exe
Token: 34	5724	powershell.exe
Token: 35	5724	powershell.exe
Token: 36	5724	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe
Token: 34	4328	powershell.exe
Token: 35	4328	powershell.exe
Token: 36	4328	powershell.exe
Token: SeDebugPrivilege	1696	SecurityHealthSystray.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4492	1836	nonagon installer.exe	88
PID 1836 wrote to memory of 4332	1836	nonagon installer.exe	89
PID 4492 wrote to memory of 460	4492	payload.exe	93
PID 4332 wrote to memory of 1696	4332	windivert.exe	94
PID 460 wrote to memory of 5724	460	WUDFHost.exe	95
PID 1696 wrote to memory of 4328	1696	SecurityHealthSystray.exe	97
PID 1696 wrote to memory of 6120	1696	SecurityHealthSystray.exe	99
PID 5724 wrote to memory of 5556	5724	powershell.exe	102

C:\Users\Admin\AppData\Local\Temp\nonagon installer.exe
"C:\Users\Admin\AppData\Local\Temp\nonagon installer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\uadeg_0e59b26e\payload.exe
  "C:\Users\Admin\AppData\Local\uadeg_0e59b26e\payload.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Program Files (x86)\Adobe\WUDFHost.exe
    "C:\Program Files (x86)\Adobe\WUDFHost.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      UAC bypass
      Badlisted process makes network request
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5724
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5556
- C:\Users\Admin\AppData\Local\uadeg_0e59b26e\windivert.exe
  "C:\Users\Admin\AppData\Local\uadeg_0e59b26e\windivert.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Users\Admin\AppData\Local\PeerDistRepub\SecurityHealthSystray.exe
    C:\Users\Admin\AppData\Local\PeerDistRepub\SecurityHealthSystray.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthSystray.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthSystray.exe" -
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:6120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 23KB
SHA256 d2ee9cc734eb291cfad039c6c5f6ed03568261bdb775c655d5065b84a91a2655
MD5 5f3c057042267992ffd863a4392babec
SHA1 59693c2ffa01d213cf52c19afaa41021a8c66e56
SHA512 45bd75618d4d25bd8ecbfb73b09ff9dc6a63a1cfa39a94e9f7edd19bda719b970c0c5cf02fe7a444063314acc0f1e6548a6b1c5623e7f2bc00efbb1758c0f2c1
SSDEEP 384:D81eBaoa91iBW6GW14b8qukut+HbaCC7wonNIArlZJ4R9LXeqWfcRRxtocZZgETm:kexaH6WhWigqukK+O04IArTJQbeBcrxg
TLSH
T120B2B578213F5DC7D8C216B001D202B7FBE4D449DAB555D8BF2FDA2F4CA0EB64AA1624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_osdwosnb.hfh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_osdwosnb.hfh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

payload.exe

Path C:\Users\Admin\AppData\Local\uadeg_0e59b26e\payload.exe
Size 3.4MB
SHA256 0ad4d06d6424759dbd3a22cc6e654490709ffdb91ee96e2967a52cc7a5c07a91
MD5 4e8992c0ef9ccb00072b87a54db6eaee
SHA1 9f214ac685ec0b503cfd552b522fec1c4f59ed4e
SHA512 3891de967b5f688e77fbc04ffbfb1a088fca414aa79a1b2687c6a4c46e919e6cc737a99d78ed0b07d4b3a74de1c202aa8af2f239c3921e7bdd28e09d2776f676
SSDEEP 49152:NuY/9BsBi84iVfPkiL29dKhBPFw0dC4VfRleU6B0wv04oyDKk9rb/xxT9sa1VKFd:NfWk6tLwdVK6L8bfk9P2gKFYn93
TLSH
T1E0F533E1DEEE5C93C9632230983DA2B3838FB41B967D47E48651B4F11316DB682897C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windivert.exe

Path C:\Users\Admin\AppData\Local\uadeg_0e59b26e\windivert.exe
Size 3.4MB
SHA256 cc0390d25654f4d87398f6f542e17501acd2a1bc851e52955bf46aeaaf7b795e
MD5 d38f5b546f6601fed0730ca907c4df97
SHA1 5bf7c0edf564dac193295c6b8a20fc964d6fb761
SHA512 e292c9bd7c32df4a080759e7c1fe881e261450cd45dd1e9548083fab56c6db7cb4421fd349f577c30eac018ba4e6ad204801db6819ef5c4500913cdb380c1f76
SSDEEP 98304:C9qK15nyISx5BDC0bFq4dHh1LJUirDo0PqQdRLW:DK1ZRSxPNw4dLLGeM0yQdRLW
TLSH
T171F533131E327106E27C63798110778C196E1662EB5FF261D9F5E8EC652BEF3B20642B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-96-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-92-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-94-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-88-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-35-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-98-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-100-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-24-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-43-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-41-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-38-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/460-36-0x00000000009C0000-0x0000000001616000-memory.dmp

Download

memory/1696-39-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-95-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-37-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-34-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-42-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-91-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-101-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-93-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-99-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-54-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/1696-97-0x0000000000C80000-0x00000000018D5000-memory.dmp

Download

memory/4328-77-0x0000000070EC0000-0x0000000070F0C000-memory.dmp

Download

memory/4328-78-0x00000000710A0000-0x00000000713FB000-memory.dmp

Download

memory/4332-11-0x0000000000C10000-0x0000000001865000-memory.dmp

Download

memory/4332-14-0x0000000000C10000-0x0000000001865000-memory.dmp

Download

memory/4332-12-0x0000000000C10000-0x0000000001865000-memory.dmp

Download

memory/4332-16-0x0000000000C10000-0x0000000001865000-memory.dmp

Download

memory/4332-33-0x0000000000C10000-0x0000000001865000-memory.dmp

Download

memory/4332-9-0x0000000000C10000-0x0000000001865000-memory.dmp

Download

memory/4332-25-0x0000000000C10000-0x0000000001865000-memory.dmp

Download

memory/4492-13-0x0000000000400000-0x0000000001056000-memory.dmp

Download

memory/4492-15-0x0000000000400000-0x0000000001056000-memory.dmp

Download

memory/4492-22-0x0000000000400000-0x0000000001056000-memory.dmp

Download

memory/4492-10-0x0000000000400000-0x0000000001056000-memory.dmp

Download

memory/4492-4-0x0000000000400000-0x0000000001056000-memory.dmp

Download

memory/5724-52-0x0000000006390000-0x00000000063AE000-memory.dmp

Download

memory/5724-58-0x00000000710A0000-0x00000000713FB000-memory.dmp

Download

memory/5724-44-0x0000000002B60000-0x0000000002B96000-memory.dmp

Download

memory/5724-74-0x0000000007B00000-0x0000000007B96000-memory.dmp

Download

memory/5724-45-0x0000000005540000-0x0000000005B8A000-memory.dmp

Download

memory/5724-67-0x00000000079F0000-0x0000000007A0A000-memory.dmp

Download

memory/5724-66-0x0000000008030000-0x00000000086AC000-memory.dmp

Download

memory/5724-81-0x0000000007F00000-0x0000000007F22000-memory.dmp

Download

memory/5724-82-0x0000000008C70000-0x000000000922A000-memory.dmp

Download

memory/5724-62-0x00000000078A0000-0x0000000007943000-memory.dmp

Download

memory/5724-61-0x0000000007880000-0x00000000078A0000-memory.dmp

Download

memory/5724-69-0x0000000007A50000-0x0000000007A5A000-memory.dmp

Download

memory/5724-57-0x0000000070EC0000-0x0000000070F0C000-memory.dmp

Download

memory/5724-56-0x0000000007840000-0x0000000007876000-memory.dmp

Download

memory/5724-55-0x0000000006960000-0x00000000069A8000-memory.dmp

Download

memory/5724-53-0x00000000063E0000-0x000000000642C000-memory.dmp

Download

memory/5724-51-0x0000000005E40000-0x000000000619B000-memory.dmp

Download

memory/5724-48-0x0000000005D10000-0x0000000005D76000-memory.dmp

Download

memory/5724-47-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Download

memory/5724-46-0x0000000005C00000-0x0000000005C22000-memory.dmp

Download

memory/6120-76-0x0000000000570000-0x00000000011C5000-memory.dmp

Download

memory/6120-73-0x0000000000570000-0x00000000011C5000-memory.dmp

Download