salatstealer | 05f47f2d7c2d7d13adb5678177a59f6b04ed13250c40637a2aa441eca5150648

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader by Sexsoldier.exe
Size 22.1MB
Sample261027-clg6daay2m
SHA256 05f47f2d7c2d7d13adb5678177a59f6b04ed13250c40637a2aa441eca5150648
MD5 baad745311246fbfc2b70fcfacdd42c5
SHA1 9feb6ccc89072ebadab241cc5aac54e43a875174
SHA512 c2d77c876867313bd575f212880f43cf41864217eca9bb1de9f3bd9781c6763c4e7d1fd2eba5cfa68ec1e703c1aff6f4f3d6eb2b2b016773474fc221f4d759f7
SSDEEP 393216:RbjfJq+yKFVy9ZgnnWzDp8tfOwiEaeczzTAQcFed+VZRQL+XOmJmEPlJnr8+dKYB:VjwYmZKCDplFVvhdeRAEtJY+lI6/
TLSH
T18D3733A2DBB0D321E78FC175885593125D1ABA64EC255F8F7A01B54D2FF7282FA086C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura credential_access defense_evasion discovery salatstealer packer persistence spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 19 IoCs

resource	yara_rule
behavioral2/memory/3560-13-0x0000000000E10000-0x0000000001A67000-memory.dmp	family_salatstealer
behavioral2/memory/3560-44-0x0000000000E10000-0x0000000001A67000-memory.dmp	family_salatstealer
behavioral2/memory/3560-46-0x0000000000E10000-0x0000000001A67000-memory.dmp	family_salatstealer
behavioral2/memory/3560-49-0x0000000000E10000-0x0000000001A67000-memory.dmp	family_salatstealer
behavioral2/memory/3560-51-0x0000000000E10000-0x0000000001A67000-memory.dmp	family_salatstealer
behavioral2/memory/3560-58-0x0000000000E10000-0x0000000001A67000-memory.dmp	family_salatstealer
behavioral2/memory/2940-65-0x0000000000C40000-0x0000000001897000-memory.dmp	family_salatstealer
behavioral2/memory/2916-67-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/2916-69-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/2916-71-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/3092-89-0x0000000001000000-0x0000000001C57000-memory.dmp	family_salatstealer
behavioral2/memory/2916-110-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/2916-113-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/2916-115-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/2916-117-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/2916-119-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/2916-121-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/2916-123-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer
behavioral2/memory/2916-125-0x0000000000A80000-0x00000000016D7000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
38	1164	powershell.exe
39	1164	powershell.exe
40	1164	powershell.exe
41	1164	powershell.exe
42	1164	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 3 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe	svchost.exe

Executes dropped EXE 8 IoCs

pid	Process
3560	conhost.exe
2616	Loader by Sexsoldier.exe
3804	svchost.exe
5188	svchost.exe
5940	svchost.exe
2916	SearchHost.exe
2940	spoolsv.exe
3092	SearchHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemAutoLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\SystemData\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Program Files (x86)\\Common Files\\spoolsv.exe"	conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchHost = "C:\\Program Files (x86)\\WindowsPowerShell\\SearchHost.exe"	conhost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c4e8-10.dat	upx
behavioral2/memory/3560-13-0x0000000000E10000-0x0000000001A67000-memory.dmp	upx
behavioral2/memory/3560-44-0x0000000000E10000-0x0000000001A67000-memory.dmp	upx
behavioral2/memory/3560-46-0x0000000000E10000-0x0000000001A67000-memory.dmp	upx
behavioral2/memory/3560-49-0x0000000000E10000-0x0000000001A67000-memory.dmp	upx
behavioral2/memory/3560-51-0x0000000000E10000-0x0000000001A67000-memory.dmp	upx
behavioral2/memory/3560-58-0x0000000000E10000-0x0000000001A67000-memory.dmp	upx
behavioral2/memory/2916-60-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2940-63-0x0000000000C40000-0x0000000001897000-memory.dmp	upx
behavioral2/memory/2940-65-0x0000000000C40000-0x0000000001897000-memory.dmp	upx
behavioral2/memory/2916-67-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2916-69-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2916-71-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/3092-87-0x0000000001000000-0x0000000001C57000-memory.dmp	upx
behavioral2/memory/3092-89-0x0000000001000000-0x0000000001C57000-memory.dmp	upx
behavioral2/memory/2916-110-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2916-113-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2916-115-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2916-117-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2916-119-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2916-121-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2916-123-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx
behavioral2/memory/2916-125-0x0000000000A80000-0x00000000016D7000-memory.dmp	upx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000d00000001c4ec-15.dat	costura

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe	SearchHost.exe
File opened for modification	C:\Program Files (x86)\Common Files\71b6ae7e-01b6-7970-1d49-a43d159d7e01	conhost.exe
File opened for modification	C:\Program Files (x86)\Common Files\spoolsv.exe	conhost.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\71b6ae7e-01b6-7970-1d49-a43d159d7e01	conhost.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\SearchHost.exe	conhost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	conhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	conhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	spoolsv.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader by Sexsoldier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3560	conhost.exe
3560	conhost.exe
3560	conhost.exe
3560	conhost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
1164	powershell.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
1164	powershell.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe
2916	SearchHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	SearchHost.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeIncreaseQuotaPrivilege	1164	powershell.exe
Token: SeSecurityPrivilege	1164	powershell.exe
Token: SeTakeOwnershipPrivilege	1164	powershell.exe
Token: SeLoadDriverPrivilege	1164	powershell.exe
Token: SeSystemProfilePrivilege	1164	powershell.exe
Token: SeSystemtimePrivilege	1164	powershell.exe
Token: SeProfSingleProcessPrivilege	1164	powershell.exe
Token: SeIncBasePriorityPrivilege	1164	powershell.exe
Token: SeCreatePagefilePrivilege	1164	powershell.exe
Token: SeBackupPrivilege	1164	powershell.exe
Token: SeRestorePrivilege	1164	powershell.exe
Token: SeShutdownPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeSystemEnvironmentPrivilege	1164	powershell.exe
Token: SeRemoteShutdownPrivilege	1164	powershell.exe
Token: SeUndockPrivilege	1164	powershell.exe
Token: SeManageVolumePrivilege	1164	powershell.exe
Token: 33	1164	powershell.exe
Token: 34	1164	powershell.exe
Token: 35	1164	powershell.exe
Token: 36	1164	powershell.exe
Token: SeIncreaseQuotaPrivilege	1164	powershell.exe
Token: SeSecurityPrivilege	1164	powershell.exe
Token: SeTakeOwnershipPrivilege	1164	powershell.exe
Token: SeLoadDriverPrivilege	1164	powershell.exe
Token: SeSystemProfilePrivilege	1164	powershell.exe
Token: SeSystemtimePrivilege	1164	powershell.exe
Token: SeProfSingleProcessPrivilege	1164	powershell.exe
Token: SeIncBasePriorityPrivilege	1164	powershell.exe
Token: SeCreatePagefilePrivilege	1164	powershell.exe
Token: SeBackupPrivilege	1164	powershell.exe
Token: SeRestorePrivilege	1164	powershell.exe
Token: SeShutdownPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeSystemEnvironmentPrivilege	1164	powershell.exe
Token: SeRemoteShutdownPrivilege	1164	powershell.exe
Token: SeUndockPrivilege	1164	powershell.exe
Token: SeManageVolumePrivilege	1164	powershell.exe
Token: 33	1164	powershell.exe
Token: 34	1164	powershell.exe
Token: 35	1164	powershell.exe
Token: 36	1164	powershell.exe
Token: SeIncreaseQuotaPrivilege	1164	powershell.exe
Token: SeSecurityPrivilege	1164	powershell.exe
Token: SeTakeOwnershipPrivilege	1164	powershell.exe
Token: SeLoadDriverPrivilege	1164	powershell.exe
Token: SeSystemProfilePrivilege	1164	powershell.exe
Token: SeSystemtimePrivilege	1164	powershell.exe
Token: SeProfSingleProcessPrivilege	1164	powershell.exe
Token: SeIncBasePriorityPrivilege	1164	powershell.exe
Token: SeCreatePagefilePrivilege	1164	powershell.exe
Token: SeBackupPrivilege	1164	powershell.exe
Token: SeRestorePrivilege	1164	powershell.exe
Token: SeShutdownPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeSystemEnvironmentPrivilege	1164	powershell.exe
Token: SeRemoteShutdownPrivilege	1164	powershell.exe
Token: SeUndockPrivilege	1164	powershell.exe
Token: SeManageVolumePrivilege	1164	powershell.exe
Token: 33	1164	powershell.exe
Token: 34	1164	powershell.exe
Token: 35	1164	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 3560	5624	Loader by Sexsoldier.exe	89
PID 5624 wrote to memory of 2616	5624	Loader by Sexsoldier.exe	90
PID 5624 wrote to memory of 3804	5624	Loader by Sexsoldier.exe	91
PID 3804 wrote to memory of 5188	3804	svchost.exe	92
PID 3560 wrote to memory of 2916	3560	conhost.exe	97
PID 2916 wrote to memory of 1164	2916	SearchHost.exe	101
PID 2916 wrote to memory of 3092	2916	SearchHost.exe	103
PID 1164 wrote to memory of 944	1164	powershell.exe	106

C:\Users\Admin\AppData\Local\Temp\Loader by Sexsoldier.exe
"C:\Users\Admin\AppData\Local\Temp\Loader by Sexsoldier.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5624
- C:\ProgramData\Microsoft\Windows\WER\Temp\7353377b06c5\conhost.exe
  "C:\ProgramData\Microsoft\Windows\WER\Temp\7353377b06c5\conhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Program Files (x86)\WindowsPowerShell\SearchHost.exe
    "C:\Program Files (x86)\WindowsPowerShell\SearchHost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      UAC bypass
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1164
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe" -
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:3092
- C:\ProgramData\Microsoft\Windows\WER\Temp\7353377b06c5\Loader by Sexsoldier.exe
  "C:\ProgramData\Microsoft\Windows\WER\Temp\7353377b06c5\Loader by Sexsoldier.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2616
- C:\ProgramData\Microsoft\Windows\WER\Temp\7353377b06c5\svchost.exe
  "C:\ProgramData\Microsoft\Windows\WER\Temp\7353377b06c5\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe
    "C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe"
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5188

C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe
C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5940

C:\Program Files (x86)\Common Files\spoolsv.exe
"C:\Program Files (x86)\Common Files\spoolsv.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Loader by Sexsoldier.exe

Path C:\ProgramData\Microsoft\Windows\WER\Temp\7353377b06c5\Loader by Sexsoldier.exe
Size 16.0MB
SHA256 5651144a94d61f734793b7295dfdb6f1e0e89a84528a8ffa01ea8a121897631f
MD5 cd6848e12ce930b49ad21581502d4843
SHA1 66d34364477abd6d7f37f4ec22bf63ee3710aba9
SHA512 c89699bce0a061107f240953b069b596fab325d84df798d49b15265fe23d8441aa7e4e905dff293e3e1334b60dc22ceff7077d913cb5d6033e164a898ddeaab9
SSDEEP 393216:wFVy9ZgnnWzDp8tfOwiEaeczzTAQcFed+VZRQL+XOmJmEPlJnr:6mZKCDplFVvhdeRAEtJ
TLSH
T109073373AF70F131FF9740B8A982A722A6667BB5A132C10FAC00469D45F435BEA417D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

conhost.exe

Path C:\ProgramData\Microsoft\Windows\WER\Temp\7353377b06c5\conhost.exe
Size 3.4MB
SHA256 8f295c29070adb00789bad0e1430d6e1f97b2e8e7c61eb86b91ca8fe19965645
MD5 516edca661e09e8f9a751154be7a3a4b
SHA1 d0f3ad11fe7af6eb50cc9a6c61d501114bff0128
SHA512 3e900fc4784b4f022119896a3741908c92f221500bed563d8c9419f38fcc8b9de0b4779ea0a27fd3110f318dad1521c908fed3c9bd73cec4e676c66749f08735
SSDEEP 98304:VtmWZtlL5RUzMnJDWWAz8ZBacbR5yUTbFNCmuf1:VXbjfnJqW5WcbR5yU0
TLSH
T180F533702E5E8BD3D2C6EE729B577D4A04479BB6D1483A83DA2302269E3E5470EF1C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\ProgramData\Microsoft\Windows\WER\Temp\7353377b06c5\svchost.exe
Size 2.7MB
SHA256 5ad907215d8f6ea094927314b5847aed0667f0591304a9a70fe486682e48ee18
MD5 548e885f59ad952996af78f5e6a64d6c
SHA1 cd9f4cc756fb7495d00a39bd6060a194f71395d6
SHA512 751adb31c2403ba4d697b19f676052bb89c9aa064b595f955ca76896f23a355d9230605d6ddd83174d31e0107fef7cd7685d3bda505cb189c3c294f0ed1c3fe4
SSDEEP 49152:DTj2ZVjo2k0MEIdkB+2b42HVfx7cQgJmriR0zKiXJhuGgxeCX:b27k2k0MEIdsj4237cruKcJhYxeCX
TLSH
T143D501D1CBB5C70AD24EC7764878838A5C29B545DC896FD63396F8157FAB1C0FA2C282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gvvtavz1.kdm.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gvvtavz1.kdm.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_tracking.dat

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_tracking.dat
Size 28B
SHA256 f97a850260fc72b1cc53067c2079a5277dc196e2c1a42d864c3fe6dea847f1cb
MD5 bf63ea38b263b4487a6a4613ff9e7244
SHA1 ff1314f409573d16fcad1fbb117fb5e782e130ec
SHA512 0ea29b17f69ed6aa2d809efddd9f37c8f2a8f46f12b6827f560397b815000c7eeb87d5326f4b7e9c70d99a6d327486c0690c4f19f0cff1c6658f48507e5a6597
MD5 SHA1 SHA512

Submit Download

system_cache.log

Path C:\Users\Admin\AppData\Local\Temp\system_cache.log
Size 469B
SHA256 832cdd37223023cbd6dfeef7b40b8dc73826fe1a753889410e295904ef03e5cf
MD5 07f46e3e08aec06cd7cc6c52e7088ef9
SHA1 f4e9a18cc8742614aacbbc11b380c83f70b8d656
SHA512 90db356a520af2e10c685e52818af6e2f071ec5b66126b672b4f268ef5b82f03ba8c90e29b45188c880d2c4c3489b912551dc946ba2f7249f54c664d14683af0
TLSH
T128F0E26943785076B8240B6A04DF3FF3D816B12806010999766A83F0B78F40A6C2BAD1
MD5 SHA1 SHA512 TLSH

Submit Download

system_cache.log

Path C:\Users\Admin\AppData\Local\Temp\system_cache.log
Size 542B
SHA256 c450ffb1b16c38aeff591d6eeb8383bf6c11b12594e4658e4b733a43a8bf92a7
MD5 709affbc87983c2d9d1eff8ea8bed01a
SHA1 125bbee7daffcd60053b479275277d1948c26d64
SHA512 c746d200707fde6a556ce1237ac5cbf3502ff880325f7534e3742fcd37be67b4721f04c9ed7f83e1ae17783d166c20fe95f6ddd6afa958f58b18829a8eaccedc
TLSH
T10FF0C2A94378507AB8640B6640DF2FF3D816B13846115989766E83E0B78F40A5C2B6E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1164-98-0x00000000085B0000-0x0000000008C2C000-memory.dmp

Download

memory/1164-91-0x0000000007DF0000-0x0000000007E26000-memory.dmp

Download

memory/1164-101-0x0000000008080000-0x0000000008116000-memory.dmp

Download

memory/1164-92-0x000000006BFE0000-0x000000006C02C000-memory.dmp

Download

memory/1164-93-0x000000006C150000-0x000000006C4AB000-memory.dmp

Download

memory/1164-72-0x0000000003180000-0x00000000031B6000-memory.dmp

Download

memory/1164-99-0x0000000007F70000-0x0000000007F8A000-memory.dmp

Download

memory/1164-96-0x0000000007E30000-0x0000000007E50000-memory.dmp

Download

memory/1164-97-0x0000000007E50000-0x0000000007EF3000-memory.dmp

Download

memory/1164-103-0x00000000091F0000-0x00000000097AA000-memory.dmp

Download

memory/1164-90-0x0000000006F70000-0x0000000006FB8000-memory.dmp

Download

memory/1164-83-0x00000000069F0000-0x0000000006A3C000-memory.dmp

Download

memory/1164-102-0x00000000084F0000-0x0000000008512000-memory.dmp

Download

memory/1164-82-0x00000000069B0000-0x00000000069CE000-memory.dmp

Download

memory/1164-79-0x0000000006590000-0x00000000068EB000-memory.dmp

Download

memory/1164-74-0x0000000005CC0000-0x0000000005CE2000-memory.dmp

Download

memory/1164-75-0x00000000063F0000-0x0000000006456000-memory.dmp

Download

memory/1164-76-0x0000000006460000-0x00000000064C6000-memory.dmp

Download

memory/1164-100-0x0000000007FD0000-0x0000000007FDA000-memory.dmp

Download

memory/1164-73-0x0000000005DA0000-0x00000000063EA000-memory.dmp

Download

memory/2616-39-0x00000000066D0000-0x00000000066DE000-memory.dmp

Download

memory/2616-37-0x00000000066C0000-0x00000000066C8000-memory.dmp

Download

memory/2616-17-0x0000000074882000-0x0000000074883000-memory.dmp

Download

memory/2616-18-0x0000000000A60000-0x0000000001A6C000-memory.dmp

Download

memory/2616-29-0x0000000074870000-0x000000007502C000-memory.dmp

Download

memory/2616-38-0x0000000007120000-0x000000000715E000-memory.dmp

Download

memory/2616-47-0x0000000074882000-0x0000000074883000-memory.dmp

Download

memory/2616-48-0x0000000074870000-0x000000007502C000-memory.dmp

Download

memory/2916-67-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-69-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-113-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-71-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-110-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-119-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-115-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-121-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-117-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-123-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-125-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2916-60-0x0000000000A80000-0x00000000016D7000-memory.dmp

Download

memory/2940-65-0x0000000000C40000-0x0000000001897000-memory.dmp

Download

memory/2940-63-0x0000000000C40000-0x0000000001897000-memory.dmp

Download

memory/3092-87-0x0000000001000000-0x0000000001C57000-memory.dmp

Download

memory/3092-89-0x0000000001000000-0x0000000001C57000-memory.dmp

Download

memory/3560-13-0x0000000000E10000-0x0000000001A67000-memory.dmp

Download

memory/3560-51-0x0000000000E10000-0x0000000001A67000-memory.dmp

Download

memory/3560-44-0x0000000000E10000-0x0000000001A67000-memory.dmp

Download

memory/3560-46-0x0000000000E10000-0x0000000001A67000-memory.dmp

Download

memory/3560-58-0x0000000000E10000-0x0000000001A67000-memory.dmp

Download

memory/3560-49-0x0000000000E10000-0x0000000001A67000-memory.dmp

Download

memory/3804-22-0x00000000006C0000-0x000000000096E000-memory.dmp

Download

memory/3804-25-0x0000000074870000-0x000000007502C000-memory.dmp

Download

memory/3804-40-0x0000000074870000-0x000000007502C000-memory.dmp

Download

memory/5624-23-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5624-1-0x00007FF89FD7F000-0x00007FF89FD80000-memory.dmp

Download

memory/5624-9-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5624-12-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5624-0-0x0000000000AA0000-0x0000000000AA8000-memory.dmp

Download