lumma | 9dc125cde7076813d0cec6aa572cf13c5bcda6bc0e6b1ea6d612e405ef99b647

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0b5cbf843bdbe3eddff2ae06a7cd8907.exe
Size

394KB
MD5

0b5cbf843bdbe3eddff2ae06a7cd8907
SHA1

38716ee27322f9a205f608ebcb40bb0cbc0ea42e
SHA256

9dc125cde7076813d0cec6aa572cf13c5bcda6bc0e6b1ea6d612e405ef99b647
SHA512

a52d8ab832d3b82c1f5fbc49fc0c6d9755e45ef37753c1608ea95c2bfcbae8c9b08829dd7758cb2368a73160ccd020d1ae29c1eb9f8d0b3f6f0e1a36f133a284
SSDEEP

12288:AmQ9dCrejHa1c2obY7XQNSWShDYRtmLnrqYV9:Aq6jHIocYSM2nrqg

Score

10^/10

lumma evasion stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 20 IoCs

resource	yara_rule
behavioral2/memory/4872-205-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/4984-275-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/4984-404-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/4684-285-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/4684-422-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/4684-534-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/3736-536-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/3736-665-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/4892-681-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/4892-792-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/2148-795-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/2148-918-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/32-936-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/32-1026-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/4104-1049-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/4104-1182-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/5052-1192-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/5052-1221-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/2164-1305-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4
behavioral2/memory/2164-1430-0x0000000000400000-0x000000000056E000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies security service 2 TTPs 22 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe

Executes dropped EXE 10 IoCs

pid	Process
4984	scrov.exe
4684	scrov.exe
3736	scrov.exe
4892	scrov.exe
2148	scrov.exe
32	scrov.exe
4104	scrov.exe
5052	scrov.exe
2164	scrov.exe
3472	scrov.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	0b5cbf843bdbe3eddff2ae06a7cd8907.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	0b5cbf843bdbe3eddff2ae06a7cd8907.exe
File created	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe
File opened for modification	C:\Windows\SysWOW64\scrov.exe	scrov.exe

Runs .reg file with regedit 11 IoCs

pid	Process
2212	regedit.exe
32	regedit.exe
1224	regedit.exe
2368	regedit.exe
2620	regedit.exe
4524	regedit.exe
4916	regedit.exe
5112	regedit.exe
3972	regedit.exe
5044	regedit.exe
1080	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3628	4872	0b5cbf843bdbe3eddff2ae06a7cd8907.exe	98
PID 4872 wrote to memory of 3628	4872	0b5cbf843bdbe3eddff2ae06a7cd8907.exe	98
PID 4872 wrote to memory of 3628	4872	0b5cbf843bdbe3eddff2ae06a7cd8907.exe	98
PID 3628 wrote to memory of 4524	3628	cmd.exe	96
PID 3628 wrote to memory of 4524	3628	cmd.exe	96
PID 3628 wrote to memory of 4524	3628	cmd.exe	96
PID 4872 wrote to memory of 4984	4872	0b5cbf843bdbe3eddff2ae06a7cd8907.exe	89
PID 4872 wrote to memory of 4984	4872	0b5cbf843bdbe3eddff2ae06a7cd8907.exe	89
PID 4872 wrote to memory of 4984	4872	0b5cbf843bdbe3eddff2ae06a7cd8907.exe	89
PID 4984 wrote to memory of 4032	4984	scrov.exe	94
PID 4984 wrote to memory of 4032	4984	scrov.exe	94
PID 4984 wrote to memory of 4032	4984	scrov.exe	94
PID 4032 wrote to memory of 2620	4032	cmd.exe	91
PID 4032 wrote to memory of 2620	4032	cmd.exe	91
PID 4032 wrote to memory of 2620	4032	cmd.exe	91
PID 4984 wrote to memory of 4684	4984	scrov.exe	108
PID 4984 wrote to memory of 4684	4984	scrov.exe	108
PID 4984 wrote to memory of 4684	4984	scrov.exe	108
PID 4684 wrote to memory of 3708	4684	scrov.exe	107
PID 4684 wrote to memory of 3708	4684	scrov.exe	107
PID 4684 wrote to memory of 3708	4684	scrov.exe	107
PID 3708 wrote to memory of 4916	3708	cmd.exe	106
PID 3708 wrote to memory of 4916	3708	cmd.exe	106
PID 3708 wrote to memory of 4916	3708	cmd.exe	106
PID 4684 wrote to memory of 3736	4684	scrov.exe	111
PID 4684 wrote to memory of 3736	4684	scrov.exe	111
PID 4684 wrote to memory of 3736	4684	scrov.exe	111
PID 3736 wrote to memory of 1176	3736	scrov.exe	112
PID 3736 wrote to memory of 1176	3736	scrov.exe	112
PID 3736 wrote to memory of 1176	3736	scrov.exe	112
PID 1176 wrote to memory of 2212	1176	cmd.exe	113
PID 1176 wrote to memory of 2212	1176	cmd.exe	113
PID 1176 wrote to memory of 2212	1176	cmd.exe	113
PID 3736 wrote to memory of 4892	3736	scrov.exe	114
PID 3736 wrote to memory of 4892	3736	scrov.exe	114
PID 3736 wrote to memory of 4892	3736	scrov.exe	114
PID 4892 wrote to memory of 5012	4892	scrov.exe	115
PID 4892 wrote to memory of 5012	4892	scrov.exe	115
PID 4892 wrote to memory of 5012	4892	scrov.exe	115
PID 5012 wrote to memory of 32	5012	cmd.exe	116
PID 5012 wrote to memory of 32	5012	cmd.exe	116
PID 5012 wrote to memory of 32	5012	cmd.exe	116
PID 4892 wrote to memory of 2148	4892	scrov.exe	117
PID 4892 wrote to memory of 2148	4892	scrov.exe	117
PID 4892 wrote to memory of 2148	4892	scrov.exe	117
PID 2148 wrote to memory of 4908	2148	scrov.exe	118
PID 2148 wrote to memory of 4908	2148	scrov.exe	118
PID 2148 wrote to memory of 4908	2148	scrov.exe	118
PID 4908 wrote to memory of 3972	4908	cmd.exe	119
PID 4908 wrote to memory of 3972	4908	cmd.exe	119
PID 4908 wrote to memory of 3972	4908	cmd.exe	119
PID 2148 wrote to memory of 32	2148	scrov.exe	121
PID 2148 wrote to memory of 32	2148	scrov.exe	121
PID 2148 wrote to memory of 32	2148	scrov.exe	121
PID 32 wrote to memory of 4328	32	scrov.exe	122
PID 32 wrote to memory of 4328	32	scrov.exe	122
PID 32 wrote to memory of 4328	32	scrov.exe	122
PID 4328 wrote to memory of 5044	4328	cmd.exe	123
PID 4328 wrote to memory of 5044	4328	cmd.exe	123
PID 4328 wrote to memory of 5044	4328	cmd.exe	123
PID 32 wrote to memory of 4104	32	scrov.exe	124
PID 32 wrote to memory of 4104	32	scrov.exe	124
PID 32 wrote to memory of 4104	32	scrov.exe	124
PID 4104 wrote to memory of 1664	4104	scrov.exe	126

C:\Users\Admin\AppData\Local\Temp\0b5cbf843bdbe3eddff2ae06a7cd8907.exe
"C:\Users\Admin\AppData\Local\Temp\0b5cbf843bdbe3eddff2ae06a7cd8907.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\scrov.exe
  C:\Windows\system32\scrov.exe 1200 "C:\Users\Admin\AppData\Local\Temp\0b5cbf843bdbe3eddff2ae06a7cd8907.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\a.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4032
- - C:\Windows\SysWOW64\scrov.exe
    C:\Windows\system32\scrov.exe 1208 "C:\Windows\SysWOW64\scrov.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\scrov.exe
      C:\Windows\system32\scrov.exe 1176 "C:\Windows\SysWOW64\scrov.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3736
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1176
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2212
    - - C:\Windows\SysWOW64\scrov.exe
        
        C:\Windows\system32\scrov.exe 1172 "C:\Windows\SysWOW64\scrov.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4892
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:32
      - C:\Windows\SysWOW64\scrov.exe
        
        C:\Windows\system32\scrov.exe 1184 "C:\Windows\SysWOW64\scrov.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:3972
        
        C:\Windows\SysWOW64\scrov.exe
        
        C:\Windows\system32\scrov.exe 1188 "C:\Windows\SysWOW64\scrov.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:32
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:5044
        
        C:\Windows\SysWOW64\scrov.exe
        
        C:\Windows\system32\scrov.exe 1180 "C:\Windows\SysWOW64\scrov.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        9⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\scrov.exe
        
        C:\Windows\system32\scrov.exe 1196 "C:\Windows\SysWOW64\scrov.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        10⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:5112
        
        C:\Windows\SysWOW64\scrov.exe
        
        C:\Windows\system32\scrov.exe 1192 "C:\Windows\SysWOW64\scrov.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        11⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1224
        
        C:\Windows\SysWOW64\scrov.exe
        
        C:\Windows\system32\scrov.exe 1212 "C:\Windows\SysWOW64\scrov.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        12⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:2620

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:4524

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:4916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\a.bat
1⤵
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
784B

MD5
5a466127fedf6dbcd99adc917bd74581

SHA1
a2e60b101c8789b59360d95a64ec07d0723c4d38

SHA256
8cd3b8dd28ac014cf973d9ab4b03af1c274bbc9b5ee0ee4ab8af0bdb01573b84

SHA512
695cafc932bc8f0a514bc515860cb275297665de63ca3394b55f42c457761ebf654d29d504674681a77b34e3356a469e8c5b97ff7efc24de330d5375f025cba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
908860a865f8ed2e14085e35256578dd

SHA1
7ff5ee35cc7e96a661848eb95a70d0b8d2d78603

SHA256
d2b73d92cf00a9dc61f2777a7f298e8c4bb72697236965f8931bdfc9d0924c5f

SHA512
a93bb8cb180d957ef2b2c511d5ff66a25d2bcfb071af9884c146b8c422d1fadc9a4d390712bc2cb27640634854b3e59d5209803373cf1f42381d513747a65fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
c1e5f93e2bee9ca33872764d8889de23

SHA1
167f65adfc34a0e47cb7de92cc5958ee8905796a

SHA256
8f5276e847b1c6beb572b1eeae20f98784aae11ea2d8f8860adcdb78fd9dca3a

SHA512
482741b0df7bf6e94ba9667892fe12125df30812e21de40fd60dee540922da70ffb6db4a0c0e17346e714d4bb6e49e2d4eca53c0d5194cd888903071c82b8859

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
872656500ddac1ddd91d10aba3a8df96

SHA1
ddf655aea7e8eae37b0a2dd4c8cabaf21cf681fc

SHA256
d6f58d2fbf733d278281af0b9e7732a591cdd752e18a430f76cb7afa806c75f8

SHA512
e7fab32f6f38bde67c8ce7af483216c9965ab62a70aee5c9a9e17aa693c33c67953f817406c1687406977b234d89e62d7feb44757527de5db34e5a61462a0be9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
0bccb0cc2d0641cd0ac7ce17afe64b9f

SHA1
103f5bc2b153913e8a614a7abb43941fe90862a4

SHA256
cae50ec401dae988f1221cead7de58cf4301040fd9fbb8d1c4ad032034ee1842

SHA512
cce4edc7c607ca3969fb19f93a836d87170e2c50fcf136acb3bcb5500b99b1ae73a999b7d648a3643f58cf960b071b24215e1c59f874ca38a50cf1ef90b06389

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
851B

MD5
a13ff758fc4326eaa44582bc9700aead

SHA1
a4927b4a3b84526c5c42a077ade4652ab308f83f

SHA256
c0915178e63bf84c54e9c942b5cc80327c24d84125042767d7e1e2ef3e004588

SHA512
86c336086a1d0ca689e133df8e3c3ec83eeef86649dbf8b9d367c3e543358ad54f69d1a20d56c56200e294f22b2741186db0f359051159b4e670d3e9b5861842

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
895301bce84d6fe707b5cfd50f1f9f97

SHA1
50a012f59655621768f624c4571654145663c042

SHA256
b2c6435e83784b85e7f4bdd4568bd954029caac9f5795e3111ae75db0f9874d4

SHA512
a75188afa7c01959bcbf7b832d92d0134072eecd3dd58d6179bc626024d4c9593cadc5cf9ab00deb3824853df003a0a73c84b60cefbdcb6944d216534ea7ffc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
5b77620cb52220f4a82e3551ee0a53a6

SHA1
07d122b8e70ec5887bad4ef8f4d6209df18912d0

SHA256
93ee7aaab4bb8bb1a11aede226bdb7c2ad85197ef5054eb58531c4df35599579

SHA512
9dc2b10a03c87d294903ff3514ca38ce1e85dec66213a7042d31f70fb20d36fed645150c5a6cb6f08c31bdc9f61e7dee2f1737c98aab263c289b09ffa663371c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Windows\SysWOW64\scrov.exe

Filesize
394KB

MD5
0b5cbf843bdbe3eddff2ae06a7cd8907

SHA1
38716ee27322f9a205f608ebcb40bb0cbc0ea42e

SHA256
9dc125cde7076813d0cec6aa572cf13c5bcda6bc0e6b1ea6d612e405ef99b647

SHA512
a52d8ab832d3b82c1f5fbc49fc0c6d9755e45ef37753c1608ea95c2bfcbae8c9b08829dd7758cb2368a73160ccd020d1ae29c1eb9f8d0b3f6f0e1a36f133a284

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
memory/32-1026-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/32-936-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2148-795-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2148-918-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2164-1305-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2164-1430-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/3736-536-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/3736-665-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4104-1049-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4104-1182-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4684-534-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4684-422-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4684-285-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4684-287-0x0000000000A10000-0x0000000000A60000-memory.dmp

Filesize
320KB

Download
memory/4684-288-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/4684-290-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4684-317-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4684-400-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4684-401-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4684-291-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-12-0x0000000002C80000-0x0000000002C84000-memory.dmp

Filesize
16KB

Download
memory/4872-32-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-26-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/4872-25-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4872-23-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/4872-24-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4872-21-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4872-20-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4872-18-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/4872-17-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/4872-16-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4872-15-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/4872-14-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4872-13-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4872-28-0x0000000002C70000-0x0000000002C75000-memory.dmp

Filesize
20KB

Download
memory/4872-11-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/4872-10-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/4872-9-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/4872-7-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/4872-6-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4872-5-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/4872-4-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4872-0-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4872-1-0x0000000000710000-0x0000000000760000-memory.dmp

Filesize
320KB

Download
memory/4872-2-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/4872-3-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4872-29-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-22-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/4872-154-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/4872-30-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-31-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-27-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4872-34-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-36-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-37-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-38-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-153-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/4872-152-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/4872-151-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4872-150-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-39-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-40-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-44-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-58-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-66-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-205-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4872-149-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4872-155-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/4872-273-0x0000000000710000-0x0000000000760000-memory.dmp

Filesize
320KB

Download
memory/4892-792-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4892-681-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4984-404-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/4984-279-0x00000000038F0000-0x00000000038F1000-memory.dmp

Filesize
4KB

Download
memory/4984-281-0x0000000003910000-0x0000000003911000-memory.dmp

Filesize
4KB

Download
memory/4984-283-0x0000000003930000-0x0000000003931000-memory.dmp

Filesize
4KB

Download
memory/4984-277-0x00000000038D0000-0x00000000038D1000-memory.dmp

Filesize
4KB

Download
memory/4984-284-0x0000000003920000-0x0000000003921000-memory.dmp

Filesize
4KB

Download
memory/4984-282-0x0000000003900000-0x0000000003901000-memory.dmp

Filesize
4KB

Download
memory/4984-280-0x00000000038E0000-0x00000000038E1000-memory.dmp

Filesize
4KB

Download
memory/4984-278-0x00000000038C0000-0x00000000038C1000-memory.dmp

Filesize
4KB

Download
memory/4984-275-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/5052-1192-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/5052-1221-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads