lumma | b7969504a01437385f5865aef152e0b32b2a1344620ec08aa98c1bac580eff4b

Analysis

max time kernel
142s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ESPOTIFY SIN PUBLICIDAD/Spotify1-1-73-517.exe
Size

70.6MB
MD5

567a2857c6f4b381ce27107cb392c0e9
SHA1

ca57b08470d6281792ba78d722d48718d3439d79
SHA256

9e71d03181600209f01eb261db7ebf6fbdfee38ec1ac1974d7f61f75895473d3
SHA512

0850eda05cfdac6fe7d678bb6e22040cbe856ed6bd78c68a52846a40fc6c89a10ce95567df8d62f461193ff3929dca4a6b6c0b5bdc3cf1f661b8f420fc281336
SSDEEP

1572864:6Vt/59XSZMUZ7Q/3PjtWomEglhE5Hm2Fyh4vWVN9FNXLs:kpXSZzNQJ9glhE5rFyheWL

Score

10^/10

lumma discovery persistence stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Executes dropped EXE 3 IoCs

Processes:

Spotify.exeSpotify.exeSpotify.exe

pid process

940 Spotify.exe
1388 Spotify.exe
696 Spotify.exe

pid	process
940	Spotify.exe
1388	Spotify.exe
696	Spotify.exe

Loads dropped DLL 12 IoCs

Processes:

Spotify1-1-73-517.exeSpotify.exeSpotify.exeSpotify.exe

pid	process
1704	Spotify1-1-73-517.exe
940	Spotify.exe
1704	Spotify1-1-73-517.exe
1704	Spotify1-1-73-517.exe
940	Spotify.exe
1388	Spotify.exe
1388	Spotify.exe
696	Spotify.exe
696	Spotify.exe
696	Spotify.exe
696	Spotify.exe
696	Spotify.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe

Modifies registry class 15 IoCs

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\spotify	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\spotify\shell	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Spotify.exe

pid process

940 Spotify.exe
940 Spotify.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Spotify.exe

pid process

940 Spotify.exe
940 Spotify.exe
940 Spotify.exe
940 Spotify.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Spotify.exe

pid process

940 Spotify.exe
940 Spotify.exe
940 Spotify.exe

pid	process
940	Spotify.exe
940	Spotify.exe

pid	process
940	Spotify.exe
940	Spotify.exe
940	Spotify.exe
940	Spotify.exe

pid	process
940	Spotify.exe
940	Spotify.exe
940	Spotify.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

Spotify1-1-73-517.exeSpotify.exe

description	pid	process	target process
PID 1704 wrote to memory of 940	1704	Spotify1-1-73-517.exe	Spotify.exe
PID 1704 wrote to memory of 940	1704	Spotify1-1-73-517.exe	Spotify.exe
PID 1704 wrote to memory of 940	1704	Spotify1-1-73-517.exe	Spotify.exe
PID 1704 wrote to memory of 940	1704	Spotify1-1-73-517.exe	Spotify.exe
PID 940 wrote to memory of 1388	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 1388	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 1388	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 1388	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 696	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 1968	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 1968	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 1968	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 1968	940	Spotify.exe	Spotify.exe
PID 940 wrote to memory of 1968	940	Spotify.exe	Spotify.exe

C:\Users\Admin\AppData\Local\Temp\ESPOTIFY SIN PUBLICIDAD\Spotify1-1-73-517.exe
"C:\Users\Admin\AppData\Local\Temp\ESPOTIFY SIN PUBLICIDAD\Spotify1-1-73-517.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Spotify.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.73.517 --initial-client-data=0x27c,0x280,0x284,0x250,0x288,0x74776a30,0x74776a40,0x74776a4c
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --field-trial-handle=1200,10774824621792021056,5394965038372630130,131072 --disable-features=CalculateNativeWinOcclusion --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1240 /prefetch:2
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1200,10774824621792021056,5394965038372630130,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1596 /prefetch:8
3⤵
PID:1968

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Filesize
56B

MD5
54baefce0c499a33e902636065895506

SHA1
06f44dfe6d3d8123b147bbedd0f5acdc8a8ef18b

SHA256
243b5be1e2798897febd51a4d5efd6b38e6c1607d94c45011fa06c4d59221b8c

SHA512
bcb99e656eff84d317838d6289504f8c19f196c79c25b8edbf39a0951fde6d6a0996ecf9b56081d4aeacbac37b0433d45ad83ba7af05ed4e86b23f12f55179b5

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT~RF6c75fb.TMP
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
Filesize
3.9MB

MD5
609d3bfdbf153a74d85375a745a0d4e2

SHA1
0bd0073186dfef93c722a65de309c7132c6c97ac

SHA256
9cb657c10545e4be44c833831aa86476e44136ea27b7ee512e49f536880e3785

SHA512
3ca40c66b1f9dd7ecb60772f36f8779b71079ab1aabd81b8d796c5721cc0c8bde7ad0ee2932af01ff510a934e158e07c61c02f9dab9e89c2e0d46fa5d7d36927

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Filesize
614KB

MD5
7c2a51641cd02938d3cd8c58370c6d23

SHA1
72346f5f43efe86d7ddd1cd6117aee213977fe1d

SHA256
71e0080e8718d86b8356eca9f19a9ae7b898adf0a1b175f35a6813bf73b4f660

SHA512
c04c1c21d42093ea941cf0338d84abf6f5c8c17e9cb21930816858c29f35226a00e414c90b4633ce530153e77a2d138cc0aeb53ee7d896fe003b0a3f34bc90b9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Filesize
919KB

MD5
3a8f22265673effc9a31c2c906a0dc34

SHA1
90c489f3e1cc0347c21fb4e2b46f30f7057deb5d

SHA256
c5b31e8f2904883ad272f59a1beab3663ae2688eec847794c361649bdad319f6

SHA512
988a9cac09bd18749c620b589f3b2c955f48741d87944ebe6bc862de9b17353e360dc48010a15edfbc0f1fa56365739323702b69dd57b208f05353f3ba03cd98

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Filesize
655B

MD5
0de8df4a5ab170c6f80ba63d80390376

SHA1
9579fea263d2ebdb4a417582d87c2959de5b94b8

SHA256
8e2b9e0007c2a91d249b1d1e4237b8ec2c1dfdfd556bd60eb9157785d6a6e8c9

SHA512
a03bc8b002603e44dd775f914ea08ed08f3e1bd7f54362d96eebe4568ac8d9ed0437c9dfad24353d794f030ef5cb3e3528133ff58df31000272b832e4e600b4e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Filesize
9.7MB

MD5
224ba45e00bbbb237b34f0facbb550bf

SHA1
1b0f81da88149d9c610a8edf55f8f12a87ca67de

SHA256
8dee674ccd2387c14f01b746779c104e383d57b36c2bdc8e419c470a3d5ffadc

SHA512
c04d271288dd2eff89d91e31829586706eba95ffbab0b75c2d202a4037e66a4e2205e8a37ecf15116302c51239b1826064ed4670a3346439470b260aba0ea784

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll
Filesize
334KB

MD5
70fce613fb748691cada80536c95bb1d

SHA1
5460379674248b1943adb0da0c2920bf0f0cc60d

SHA256
ccadd45f3e89237464b3d466cd3ab212e8ac9841f1cfa330efbbb70a6fb15c95

SHA512
d339289362b09d6a1fd8e512b451f418e9231a789d3d4eb7553aec5ec089f2aeaa23a440b11671f44ed24372c5451c1772e47163940a7b243c756a5b2f92b1ea

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
Filesize
5.5MB

MD5
f2144935607946f62cefa63d6afee428

SHA1
65e21e7c313b1b36ae767ba045251184a7a73473

SHA256
4b03238dfe12bd0d738e336378627ea3f4457a97641b0fde31c4f66c2ba8f77b

SHA512
85c584188183c0407405e1bdb6fd2f85679db59828ad9ee5f0ce980d51bb354bb688ffd1f7aaa4cd6b6bf25e6c477d32282cea862e8205ab21c4e7c11f98fb52

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Filesize
283KB

MD5
f88e6aba546bb5120325126549b97168

SHA1
dd415b6cbacaeb79f6d5f6463e4e9a74cf5a6d6c

SHA256
a171d2118fd8607f572fa39d950b81cf83e2146a73385a9fadb1500aa14daa58

SHA512
dbde9991abe4eb617f81ab859424c9a06955232392b660798450e2a6222704e0338f2139d845c222bfdffb280e155bfd1fd16ce63f747887636fe5700a846368

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Filesize
13KB

MD5
e4811d2bb8407116c9d38ed98b7899be

SHA1
4624bc6a51f6408b96d9d96017e8fd251c8cbf34

SHA256
351707b2e6c2b86eef15068018a02d987c58091259f08007a9b3c70d72fcaffd

SHA512
03ff1f2408594cd3e7db9e47756ecb4e2ec7a8f09a75c9b1f9fe4aabea49cead11543636eb462bed1ff5473004f42ee344c340aeb7d68531c4b2bc66e1c01f07

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Filesize
7.3MB

MD5
b528671cd4f9a9764b928969a1b2a164

SHA1
749e4d0faae9524b8226d156748c9b0f0082192e

SHA256
3b4cf4697df9b0cdea15f31faa57701e61847016c74642abcda634243874bb08

SHA512
5706b4d9895856a3b06f9a50c146855bbb551cb7ee39ada98da5d7ee2b56dc440795ac8c163e268c8f03072411a9008d1b69b0a4fb4ec14ad6396887c5a01822

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Filesize
160KB

MD5
4fba5ce8bf10e7e11a34aba5986e329e

SHA1
278895f187db7f798d6a44639b3c14a1c0f4683a

SHA256
7f372b919a89f10f7b08adba9d9ad716910bc83d7a03f07eec392a0cd324a3aa

SHA512
f2935074fa23e8aac2a89f147b0157fa952b7cbc29f73c67cedfc60aad250e12bb7e401eb6dada28fcd3aa7d4e8c09fa9c31c4effb05225c06e5fa6866e40be1

Download Submit
\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
Filesize
3.9MB

MD5
609d3bfdbf153a74d85375a745a0d4e2

SHA1
0bd0073186dfef93c722a65de309c7132c6c97ac

SHA256
9cb657c10545e4be44c833831aa86476e44136ea27b7ee512e49f536880e3785

SHA512
3ca40c66b1f9dd7ecb60772f36f8779b71079ab1aabd81b8d796c5721cc0c8bde7ad0ee2932af01ff510a934e158e07c61c02f9dab9e89c2e0d46fa5d7d36927

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
Filesize
334KB

MD5
70fce613fb748691cada80536c95bb1d

SHA1
5460379674248b1943adb0da0c2920bf0f0cc60d

SHA256
ccadd45f3e89237464b3d466cd3ab212e8ac9841f1cfa330efbbb70a6fb15c95

SHA512
d339289362b09d6a1fd8e512b451f418e9231a789d3d4eb7553aec5ec089f2aeaa23a440b11671f44ed24372c5451c1772e47163940a7b243c756a5b2f92b1ea

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
Filesize
5.5MB

MD5
f2144935607946f62cefa63d6afee428

SHA1
65e21e7c313b1b36ae767ba045251184a7a73473

SHA256
4b03238dfe12bd0d738e336378627ea3f4457a97641b0fde31c4f66c2ba8f77b

SHA512
85c584188183c0407405e1bdb6fd2f85679db59828ad9ee5f0ce980d51bb354bb688ffd1f7aaa4cd6b6bf25e6c477d32282cea862e8205ab21c4e7c11f98fb52

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
memory/696-247-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/696-187-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/696-270-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/940-209-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/940-157-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/940-264-0x00000000075D0000-0x00000000075D1000-memory.dmp

Filesize
4KB

Download
memory/1388-186-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/1704-156-0x0000000006890000-0x0000000007AC0000-memory.dmp

Filesize
18.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads