stealc | b6fd9a1e628b0c3c7df9b49df491e02db978aadfa3e3cd95fd8f7c5bf2b0d660

Resubmissions

10/11/2026, 02:42

261110-c7hc9syscx10

10/11/2026, 02:32

261110-c1qfascd633

Analysis

user interaction
yes
max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PASS_KEY.docx
Size 22KB
Sample261110-c7hc9syscx
SHA256 b6fd9a1e628b0c3c7df9b49df491e02db978aadfa3e3cd95fd8f7c5bf2b0d660
MD5 1e0f8c9a0396e559dddf1509a7a39e13
SHA1 34c998c13f41bfebefd5adb0f122b3ca61df82ae
SHA512 1873a184de0655d86c3a056976aba240605349be5b0e846e83ed00c8450890883c242d80c2c4303a2a9aa0fedeab36e5091261bbd725c83da303e8fa696b9519
SSDEEP 384:SmDCNU6mYJ3wKobqePHWkrHAGx5qaylhoB/Co3sBJ8FKc:q8YJ3KvWu1qmB/SJ8Qc
TLSH
T126A2D024DA05FA6AE417D87E411241E3E7C500058202DABEE56DEFCEA5D25DB033E7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

eu1 discovery stealc spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

http://176.65.144.16

rc4.traffic_key

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 15 IoCs

resource	yara_rule
behavioral1/memory/1540-80-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-89-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-88-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-87-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-86-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-85-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-84-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-83-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-82-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-81-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-79-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-78-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/1540-77-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/4960-221-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3
behavioral1/memory/4960-220-0x0000000140000000-0x00000001400AF000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 3 IoCs

pid	Process
4108	t1newtest.exe
4960	Setup.exe
4376	t1newtest.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 3300 set thread context of 2804	3300	Explorer.EXE	103
PID 3300 set thread context of 2804	3300	Explorer.EXE	103
PID 3300 set thread context of 2804	3300	Explorer.EXE	103
PID 3300 set thread context of 2804	3300	Explorer.EXE	103
PID 3300 set thread context of 2804	3300	Explorer.EXE	103
PID 3300 set thread context of 2804	3300	Explorer.EXE	103
PID 3300 set thread context of 2804	3300	Explorer.EXE	103
PID 3300 set thread context of 2804	3300	Explorer.EXE	103
PID 3300 set thread context of 2804	3300	Explorer.EXE	103
PID 3300 set thread context of 2804	3300	Explorer.EXE	103

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\intractable\plaemoerly.dat	t1newtest.exe
File opened for modification	C:\Program Files\fumarole\gloengiedand	Explorer.EXE
File opened for modification	C:\Program Files (x86)\intractable\plaemoerly.dat	t1newtest.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4472	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
456	WINWORD.EXE
456	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
2804	chrome.exe
2804	chrome.exe
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4108	t1newtest.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
4376	t1newtest.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
456	WINWORD.EXE
456	WINWORD.EXE
456	WINWORD.EXE
456	WINWORD.EXE
456	WINWORD.EXE
456	WINWORD.EXE
456	WINWORD.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4108	1540	Setup.exe	101
PID 4108 wrote to memory of 3300	4108	t1newtest.exe	56
PID 4108 wrote to memory of 3300	4108	t1newtest.exe	56
PID 2804 wrote to memory of 2924	2804	chrome.exe	104
PID 2804 wrote to memory of 2784	2804	chrome.exe	105
PID 2804 wrote to memory of 2784	2804	chrome.exe	105
PID 2804 wrote to memory of 4472	2804	chrome.exe	106
PID 2804 wrote to memory of 3500	2804	chrome.exe	107
PID 2804 wrote to memory of 3500	2804	chrome.exe	107
PID 2804 wrote to memory of 2736	2804	chrome.exe	108
PID 2804 wrote to memory of 2736	2804	chrome.exe	108
PID 2804 wrote to memory of 4788	2804	chrome.exe	109
PID 2804 wrote to memory of 4788	2804	chrome.exe	109
PID 2804 wrote to memory of 3028	2804	chrome.exe	111
PID 2804 wrote to memory of 3028	2804	chrome.exe	111
PID 2804 wrote to memory of 3820	2804	chrome.exe	112
PID 2804 wrote to memory of 3820	2804	chrome.exe	112
PID 2804 wrote to memory of 940	2804	chrome.exe	114
PID 3300 wrote to memory of 4960	3300	Explorer.EXE	118
PID 4960 wrote to memory of 4376	4960	Setup.exe	119
PID 4376 wrote to memory of 3300	4376	t1newtest.exe	56
PID 4376 wrote to memory of 3300	4376	t1newtest.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\PASS_KEY.docx" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:456
- C:\Users\Admin\AppData\Local\Temp\Temp1_SETUP.zip\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_SETUP.zip\Setup.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\t1newtest.exe
    "C:\Users\Admin\AppData\Local\Temp\t1newtest.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe801cc728,0x7ffe801cc734,0x7ffe801cc740
    3⤵
    PID:2924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1804,i,5188537329895439058,3083247785201254977,262144 --field-trial-handle=2028,i,787374612600515136,11643259040955959535,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:2784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1628,i,9892181595098048038,4456130243519242542,524288 --field-trial-handle=2028,i,787374612600515136,11643259040955959535,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,2101494739113461022,10431551388500964038,524288 --field-trial-handle=2028,i,787374612600515136,11643259040955959535,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,15072774974146468259,8086365925233998576,2097152 --field-trial-handle=2028,i,787374612600515136,11643259040955959535,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,13562625737341657260,14692363202336342261,2097152 --field-trial-handle=2028,i,787374612600515136,11643259040955959535,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4000,i,8404276213856258843,7111841678519101626,2097152 --field-trial-handle=2028,i,787374612600515136,11643259040955959535,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4276 /prefetch:2
    3⤵
    PID:3028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4600,i,3596337512758150930,1804208878266485591,2097152 --field-trial-handle=2028,i,787374612600515136,11643259040955959535,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4636 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,1617377467885652059,10523389789102324085,524288 --field-trial-handle=2028,i,787374612600515136,11643259040955959535,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5396 /prefetch:8
    3⤵
    PID:940
- C:\Users\Admin\Desktop\Setup.exe
  "C:\Users\Admin\Desktop\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\t1newtest.exe
    "C:\Users\Admin\AppData\Local\Temp\t1newtest.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6a0c13b5-8e8c-4538-8d7a-5f3372d6f5ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6a0c13b5-8e8c-4538-8d7a-5f3372d6f5ce.tmp
Size 275KB
SHA256 1be3d70f97fc29d2dd5731da92056f926f6ab292c5c741321ada7f6bb04f9f5d
MD5 a6da1fb06b949dc80fb4e7d2d4b685d9
SHA1 71c3d6b525751be60f658ed60f02a452a41a3cc8
SHA512 1a679fc4abfd5e6585e67a1ab57e7201fa70dd0f1d86eedd215edf5b139ee5b5634a13282e82d610f6b4253ee7c34b3707c07bf3eed52a50fe634ff138815ab2
SSDEEP 6144:CumZl45AvViTjsRG+hFD+7t56OD9ZfSApprG:CumZlfViURGyFSXD9ZfS40
TLSH
T1E15422317A46DC3787BD564186DF6B18CF26ACEC81CA640680994FC7D2AF4190BA7D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

991900e0-573d-4076-8dc4-83bc55cfef37.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\991900e0-573d-4076-8dc4-83bc55cfef37.tmp
Size 130KB
SHA256 b01f7aafc2b94e9517db24dcd9ddb8dd04401f69fc50e4c84d8cd9ac5a151e67
MD5 326e6cb5b506cd5389916657c2122daa
SHA1 c3feeec1af49a2a8ff3a549efeaaaaf0421f896a
SHA512 30c5f8d1f80babc6c397897ed9b8ee5f1c8c2fe31a4e768b7cfefc420cb14e04f237f5acea70d06d206415bba5119cb5f875c02d66ff9ce97181e1daaa0702db
SSDEEP 3072:w+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:w+hFD+7t56OD9ZfSAppr2
TLSH
T109D31232AA91D8BBC9BC6541B157A304DE72ACED81DE3A0944495F8ED09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

955b826b-5d1e-41c5-b1ac-7be23e8498ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\955b826b-5d1e-41c5-b1ac-7be23e8498ed.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b210e1df-2793-46f3-88c0-967f4d7599b6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b210e1df-2793-46f3-88c0-967f4d7599b6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ae0c1877-3532-468d-bbb0-ba4c76463278.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ae0c1877-3532-468d-bbb0-ba4c76463278.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c5daec86-74b7-4117-b1fa-96cdc04cc18a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c5daec86-74b7-4117-b1fa-96cdc04cc18a.tmp
Size 414B
SHA256 2cf0affe881f3032a1903634c9dc20f34475621ed254472dcab980f20562b0cf
MD5 7b17ba4b7cd11d7c209404739b6937bc
SHA1 65aec78f4f1ee1a1f620aabe5584669ba3bb8e69
SHA512 3fe7529ad01927e27ad1359cd8367b41eae226158c0bfe6793405b525e6cd9920d6c3b3eec8024631c9bbf229ae054235209091a21b4e118b311b5cd223b40f1
TLSH
T185E02BEBCA22EC2728FD0B5D5490064EE74023572A50994F3B3D91088FB163A42DAC5C
MD5 SHA1 SHA512 TLSH

Submit Download

dbb12c36-a86b-41f1-8286-08e036343149.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dbb12c36-a86b-41f1-8286-08e036343149.tmp
Size 12KB
SHA256 03c35d1b1e4c0574ee43bd9d583389dcd219d50ce71de62ed43b7c4b0b27a0a6
MD5 51b293bdad02f1dee6e287116f0d41b5
SHA1 cbd3fc0f7d41596a85975b48654acf8870b09be2
SHA512 5ad470e576695ca9bfc3a228fe44cd7b0b81de8c24a820257bae5decd17112b366351177a3b2fc57236fe255a1d1fa6c5ddefcd86ae129131fa4f49c07fd6fea
SSDEEP 192:4RZxKpV8oigU7v7+pAPRp289THsb+WNn+d0pG2bcTVyIsnAUgtaJ:4RZxEYDaUX79w00k2bG8
TLSH
T11E42B42DBA10793B9CEBC22AFD617B57D7F5103160942E84E6FC892C18EB5DD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t1newtest.exe

Path C:\Users\Admin\AppData\Local\Temp\t1newtest.exe
Size 824KB
SHA256 bb494f4239ea6babe13e2728f37d3c6fae30da8deaf36bc998fd25540aacc975
MD5 e9819d21f5d3c62b332084f78dc46566
SHA1 2170207cdce24282c79ed2d7895b267b1635690c
SHA512 4780cbbb17002b4c85d509d0e6bf2c8c3534405d943ab52080e1cd7f571f14ec8e9f25905a1a11dbb0aac342a17ea9b61a51faf770398b96b418ef919b8fa27c
SSDEEP 24576:bBJc7Yz/IYOJCavDAjooGHIewJE+3UlHwj:bB+k7huMjEI1YH8
TLSH
T16F05E091B6A50BD9D83DC93582D5662A88623D121F319CEB83E0174B0F356D1FF3AB1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 342B
SHA256 4300f13c0e04710602f9d33cff9094999799c7df0fa7502d00bc6386072b4cdc
MD5 568519451c49285f7f8d5abf0d18bcc8
SHA1 c0b63836949f93467ab6b1d3779b1515afcba00a
SHA512 db2efaaee92a11c2bfb15cdf12a3e0dd086a637b5a0b19813daa7de00878df0695cf17f4f347a342fdf34c516f182c464db3128098c2c7b6c6852201ea94706e
TLSH
T1DEE08C23AB24F3F7A3BEA26C7CB9ADF097F28C48DB1C822015DC4C861D5094B508741B
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Setup.exe

Path C:\Users\Admin\Desktop\Setup.exe
Size 4.9MB
SHA256 0311c3d5fa2bfb130b116344107cdb6ec1fd28775a51fd3f0effbac88a2e735d
MD5 ec2f07686c76280c7b2fb9d8b1e802cc
SHA1 99db9b22a79286868ec5a69de35e2692b3ef3feb
SHA512 ecd6c6a32f2fdf1c6796a94b2021189f40c1b2b6aa97b5635d117e90648c15b6d413f14f4f0cda835c1574864de1a6772943a4dba663cb7d1503cb8af9598bd7
SSDEEP 49152:QbQU1QKR2f+6acqeJyRxAacnr7g3PLdPhiCmjhrjxLxB+k7huMjEI1YH86jeUb:Qbf2XeUnkPLdPhixjpNLT1DYt3
TLSH
T1C2367C077A9055E0C466DB35C1BA5263BE61BC8C973A23E70E60B2742F797D07AB6F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-57-0x00007FFE9D310000-0x00007FFE9D505000-memory.dmp

Download

memory/456-8-0x00007FFE5AB70000-0x00007FFE5AB80000-memory.dmp

Download

memory/456-11-0x00007FFE9D310000-0x00007FFE9D505000-memory.dmp

Download

memory/456-12-0x00007FFE9D310000-0x00007FFE9D505000-memory.dmp

Download

memory/456-13-0x00007FFE5AB70000-0x00007FFE5AB80000-memory.dmp

Download

memory/456-55-0x00007FFE5D390000-0x00007FFE5D3A0000-memory.dmp

Download

memory/456-54-0x00007FFE5D390000-0x00007FFE5D3A0000-memory.dmp

Download

memory/456-53-0x00007FFE5D390000-0x00007FFE5D3A0000-memory.dmp

Download

memory/456-52-0x00007FFE5D390000-0x00007FFE5D3A0000-memory.dmp

Download

memory/456-58-0x00007FFE9D310000-0x00007FFE9D505000-memory.dmp

Download

memory/456-2-0x00007FFE5D390000-0x00007FFE5D3A0000-memory.dmp

Download

memory/456-56-0x00007FFE9D310000-0x00007FFE9D505000-memory.dmp

Download

memory/456-3-0x00007FFE9D3AD000-0x00007FFE9D3AE000-memory.dmp

Download

memory/456-1-0x00007FFE5D390000-0x00007FFE5D3A0000-memory.dmp

Download

memory/456-0-0x00007FFE5D390000-0x00007FFE5D3A0000-memory.dmp

Download

memory/456-6-0x00007FFE9D310000-0x00007FFE9D505000-memory.dmp

Download

memory/456-5-0x00007FFE5D390000-0x00007FFE5D3A0000-memory.dmp

Download

memory/456-4-0x00007FFE9D310000-0x00007FFE9D505000-memory.dmp

Download

memory/456-7-0x00007FFE5D390000-0x00007FFE5D3A0000-memory.dmp

Download

memory/456-9-0x00007FFE9D310000-0x00007FFE9D505000-memory.dmp

Download

memory/456-10-0x00007FFE9D310000-0x00007FFE9D505000-memory.dmp

Download

memory/1540-85-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-79-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-78-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-82-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-83-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-84-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-81-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-86-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-87-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-88-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-89-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-80-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/1540-77-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3300-106-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-70-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-102-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-100-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-99-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-98-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-97-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-96-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-95-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-94-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-93-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-92-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-91-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-90-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-103-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-74-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-73-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-72-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-71-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-112-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-113-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-111-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-104-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-105-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-157-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-107-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-108-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-109-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-215-0x000000000DBB0000-0x000000000DC5E000-memory.dmp

Download

memory/3300-219-0x000000000DBB0000-0x000000000DC5E000-memory.dmp

Download

memory/3300-218-0x000000000DBB0000-0x000000000DC5E000-memory.dmp

Download

memory/3300-217-0x000000000DBB0000-0x000000000DC5E000-memory.dmp

Download

memory/3300-76-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-75-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/3300-213-0x000000000DBB0000-0x000000000DC5E000-memory.dmp

Download

memory/3300-216-0x000000000DBB0000-0x000000000DC5E000-memory.dmp

Download

memory/3300-214-0x000000000DBB0000-0x000000000DC5E000-memory.dmp

Download

memory/3300-110-0x000000000DB00000-0x000000000DBAE000-memory.dmp

Download

memory/4960-220-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/4960-221-0x0000000140000000-0x00000001400AF000-memory.dmp

Download