salatstealer | 524056f6ac92f3f5070985115d1267b4e2ecd0b36f3f0c3fdcc9917aa34a600e

Analysis

user interaction
yes
max time kernel
54s
max time network
74s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aimware.exe
Size 4.1MB
Sample261012-vbml8agy3j
SHA256 524056f6ac92f3f5070985115d1267b4e2ecd0b36f3f0c3fdcc9917aa34a600e
MD5 f8d4df2715d51828e98fb833242ceef6
SHA1 66b813ed215dd90632d8523c43c7b9332f19e77f
SHA512 13aafa656ee7666d5f013e8af8f6cb7d214a675414bae298b653e7ca29724cf8d61691f1ac80a414e466fc2c42dc32e0d258113444f326e252ed2e810cdb71bb
SSDEEP 98304:8WgWydLtq0vQp1K0PNodUsK0RAqqJSla/03ZY84y2GVF3Jr:u0Yk1LNZsK0RJnla/2ZY8N2KF
TLSH
T12C1633C0CB6DDE3BDF945530188E8C410EE6B5ADC0B43ADA690557CDEAB1C79CD42A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery salatstealer stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 33 IoCs

resource	yara_rule
behavioral2/memory/4248-23-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/2288-27-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4000-28-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/5284-30-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/3388-33-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4000-34-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/1604-39-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/1492-42-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4000-43-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/3780-45-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/548-47-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/800-49-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/1816-51-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4000-52-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4404-54-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/2248-56-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/2160-58-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4260-60-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/3412-62-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4000-63-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4456-65-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4532-67-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4640-69-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4852-71-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4000-72-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/6140-74-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/5724-76-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/5468-78-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/3980-80-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4000-81-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4600-83-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/4796-85-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer
behavioral2/memory/3756-87-0x0000000000490000-0x00000000010E5000-memory.dmp	family_salatstealer

Executes dropped EXE 20 IoCs

pid	Process
4000	kochvarebrat.exe
4248	kochvarebrat.exe
2288	kochvarebrat.exe
5284	kochvarebrat.exe
3388	kochvarebrat.exe
1604	kochvarebrat.exe
1492	kochvarebrat.exe
3780	kochvarebrat.exe
548	kochvarebrat.exe
800	kochvarebrat.exe
1816	kochvarebrat.exe
4404	kochvarebrat.exe
2248	kochvarebrat.exe
2160	kochvarebrat.exe
4260	kochvarebrat.exe
3412	kochvarebrat.exe
4456	kochvarebrat.exe
4532	kochvarebrat.exe
4640	kochvarebrat.exe
4852	kochvarebrat.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0004000000016b4d-7.dat	upx
behavioral2/memory/4000-12-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4248-23-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/2288-27-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4000-28-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/5284-30-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/3388-33-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4000-34-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/1604-37-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/1604-39-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/1492-42-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4000-43-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/3780-45-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/548-47-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/800-49-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/1816-51-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4000-52-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4404-54-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/2248-56-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/2160-58-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4260-60-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/3412-62-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4000-63-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4456-65-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4532-67-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4640-69-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4852-71-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4000-72-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/6140-74-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/5724-76-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/5468-78-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/3980-80-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4000-81-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4600-83-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/4796-85-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/3756-87-0x0000000000490000-0x00000000010E5000-memory.dmp	upx
behavioral2/memory/5820-89-0x0000000000490000-0x00000000010E5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 21 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kochvarebrat.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kochvarebrat.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4000	kochvarebrat.exe
4000	kochvarebrat.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4000	4584	aimware.exe	88
PID 4584 wrote to memory of 1956	4584	aimware.exe	89
PID 1956 wrote to memory of 4248	1956	aimware.exe	90
PID 1956 wrote to memory of 4144	1956	aimware.exe	91
PID 4144 wrote to memory of 2288	4144	aimware.exe	92
PID 4144 wrote to memory of 3408	4144	aimware.exe	93
PID 3408 wrote to memory of 5284	3408	aimware.exe	94
PID 3408 wrote to memory of 2436	3408	aimware.exe	95
PID 2436 wrote to memory of 3388	2436	aimware.exe	96
PID 2436 wrote to memory of 3788	2436	aimware.exe	97
PID 3788 wrote to memory of 1604	3788	aimware.exe	98
PID 3788 wrote to memory of 5568	3788	aimware.exe	99
PID 5568 wrote to memory of 1492	5568	aimware.exe	100
PID 5568 wrote to memory of 1456	5568	aimware.exe	101
PID 1456 wrote to memory of 3780	1456	aimware.exe	102
PID 1456 wrote to memory of 3592	1456	aimware.exe	103
PID 3592 wrote to memory of 548	3592	aimware.exe	104
PID 3592 wrote to memory of 1288	3592	aimware.exe	105
PID 1288 wrote to memory of 800	1288	aimware.exe	106
PID 1288 wrote to memory of 3872	1288	aimware.exe	107
PID 3872 wrote to memory of 1816	3872	aimware.exe	110
PID 3872 wrote to memory of 2324	3872	aimware.exe	111
PID 2324 wrote to memory of 4404	2324	aimware.exe	112
PID 2324 wrote to memory of 2192	2324	aimware.exe	113
PID 2192 wrote to memory of 2248	2192	aimware.exe	114
PID 2192 wrote to memory of 4388	2192	aimware.exe	115
PID 4388 wrote to memory of 2160	4388	aimware.exe	116
PID 4388 wrote to memory of 5672	4388	aimware.exe	117
PID 5672 wrote to memory of 4260	5672	aimware.exe	118
PID 5672 wrote to memory of 4628	5672	aimware.exe	119
PID 4628 wrote to memory of 3412	4628	aimware.exe	120
PID 4628 wrote to memory of 2088	4628	aimware.exe	121
PID 2088 wrote to memory of 4456	2088	aimware.exe	122
PID 2088 wrote to memory of 3560	2088	aimware.exe	123
PID 3560 wrote to memory of 4532	3560	aimware.exe	124
PID 3560 wrote to memory of 4284	3560	aimware.exe	125
PID 4284 wrote to memory of 4640	4284	aimware.exe	126
PID 4284 wrote to memory of 4052	4284	aimware.exe	127
PID 4052 wrote to memory of 4852	4052	aimware.exe	128
PID 4052 wrote to memory of 2500	4052	aimware.exe	129

C:\Users\Admin\AppData\Local\Temp\aimware.exe
"C:\Users\Admin\AppData\Local\Temp\aimware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
  "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Users\Admin\AppData\Local\Temp\aimware.exe
  "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
    "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\aimware.exe
    "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
      "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\aimware.exe
      "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        7⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        8⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        9⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        10⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        11⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        12⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        13⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        14⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        15⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        16⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        17⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        18⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        19⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        20⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        21⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        21⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        22⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        22⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        23⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        23⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        24⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        24⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        25⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        25⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        26⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        26⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        27⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        27⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        28⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        28⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe"
        29⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\aimware.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimware.exe"
        29⤵
        
        PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kochvarebrat.exe

Path C:\Users\Admin\AppData\Local\Temp\kochvarebrat.exe
Size 3.4MB
SHA256 b9149ea529fa1ef63bd43d01bc2524035ac9afa28a0712c8f37482b5fd45c945
MD5 a0833b0817a18cc5e4e548a68ea8d30e
SHA1 6124d85fb12d1a07f278bc4ae221a763073f5c4b
SHA512 d34f294e7f4e5f1319e55b51d7434a4d600883f294348c4af3b69c3718ae3061447465babb657679a609ebbac46f75f2f0d3065ebd8a65d442f4f3aed3ab2425
SSDEEP 98304:K2Kbt/aeraZdy+L1kLAG4QN8AqJkzaTMdrYa8okIxFvB9:AiwKdd1jG4QN/7zaTkrYaxkaF
TLSH
T16FF533C0DF2EED27DAA4D9341C4ED8420EF6B99DC0B42AD15E051BCCF57587ACD12A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-47-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/800-49-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/1492-42-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/1604-37-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/1604-39-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/1816-51-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/1956-19-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/1956-13-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/1956-16-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/1956-17-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/1956-18-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/1956-36-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/1956-21-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/1956-14-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/1956-24-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/2160-58-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/2248-56-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/2288-27-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/3388-33-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/3412-62-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/3756-87-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/3780-45-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/3980-80-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4000-52-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4000-43-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4000-72-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4000-34-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4000-12-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4000-81-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4000-28-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4000-63-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4248-23-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4260-60-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4404-54-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4456-65-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4532-67-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4584-2-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/4584-15-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/4584-0-0x00007FFA9E45F000-0x00007FFA9E460000-memory.dmp

Download

memory/4584-1-0x0000000000010000-0x0000000000434000-memory.dmp

Download

memory/4584-4-0x00007FFA9E2D0000-0x00007FFA9EC74000-memory.dmp

Download

memory/4600-83-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4640-69-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4796-85-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/4852-71-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/5284-30-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/5468-78-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/5724-76-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/5820-89-0x0000000000490000-0x00000000010E5000-memory.dmp

Download

memory/6140-74-0x0000000000490000-0x00000000010E5000-memory.dmp

Download