lumma | cb74efa5edabffa956e33282c67330c1926b8159486ad50f072d82fff34fe4f6

Analysis

max time kernel
206s
max time network
41s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e63ce4976bca06c996c2aaaf3559b60.exe
Size

404KB
MD5

5e63ce4976bca06c996c2aaaf3559b60
SHA1

23e42b447054455c3adca5e529ab614087e60ae1
SHA256

cb74efa5edabffa956e33282c67330c1926b8159486ad50f072d82fff34fe4f6
SHA512

eb3bd8782d03df6321c2682987c520b2fb9338c1fd4abbeaac1a355d971dafeaf6964e184cfb38ab3fa2a32d586012d62b952e806a6428fcc6669edb449f6c40
SSDEEP

6144:1Cq3j2XRXSZpdeX1cNwPLvoqg0R2VhPefm0ToKvILP96q/EymLj0GKHUmTaWFW:QIjCXSzS1c2obY7BIz9JETLwGchM

Score

10^/10

lumma evasion stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 15 IoCs

resource	yara_rule
behavioral1/memory/3032-35-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/3032-43-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/3032-44-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/3032-164-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/1360-289-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/3028-302-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/1360-304-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/3028-428-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/3028-432-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/1684-555-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/2064-682-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/2064-695-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/2912-816-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/2912-827-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4
behavioral1/memory/400-979-0x0000000000400000-0x000000000056F000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies security service 2 TTPs 16 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe

Executes dropped EXE 7 IoCs

pid	Process
1360	msnssgr.exe
3028	msnssgr.exe
1684	msnssgr.exe
2064	msnssgr.exe
2912	msnssgr.exe
400	msnssgr.exe
2108	msnssgr.exe

Loads dropped DLL 14 IoCs

pid	Process
3032	5e63ce4976bca06c996c2aaaf3559b60.exe
3032	5e63ce4976bca06c996c2aaaf3559b60.exe
1360	msnssgr.exe
1360	msnssgr.exe
3028	msnssgr.exe
3028	msnssgr.exe
1684	msnssgr.exe
1684	msnssgr.exe
2064	msnssgr.exe
2064	msnssgr.exe
2912	msnssgr.exe
2912	msnssgr.exe
400	msnssgr.exe
400	msnssgr.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File opened for modification	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File opened for modification	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File created	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File created	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File created	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File created	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File opened for modification	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File opened for modification	C:\Windows\SysWOW64\msnssgr.exe	5e63ce4976bca06c996c2aaaf3559b60.exe
File opened for modification	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File created	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File opened for modification	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File opened for modification	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File opened for modification	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe
File created	C:\Windows\SysWOW64\msnssgr.exe	5e63ce4976bca06c996c2aaaf3559b60.exe
File created	C:\Windows\SysWOW64\msnssgr.exe	msnssgr.exe

Runs .reg file with regedit 8 IoCs

pid	Process
1552	regedit.exe
1856	regedit.exe
2852	regedit.exe
1780	regedit.exe
716	regedit.exe
2760	regedit.exe
776	regedit.exe
1252	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 844	3032	5e63ce4976bca06c996c2aaaf3559b60.exe	29
PID 3032 wrote to memory of 844	3032	5e63ce4976bca06c996c2aaaf3559b60.exe	29
PID 3032 wrote to memory of 844	3032	5e63ce4976bca06c996c2aaaf3559b60.exe	29
PID 3032 wrote to memory of 844	3032	5e63ce4976bca06c996c2aaaf3559b60.exe	29
PID 844 wrote to memory of 716	844	cmd.exe	30
PID 844 wrote to memory of 716	844	cmd.exe	30
PID 844 wrote to memory of 716	844	cmd.exe	30
PID 844 wrote to memory of 716	844	cmd.exe	30
PID 3032 wrote to memory of 1360	3032	5e63ce4976bca06c996c2aaaf3559b60.exe	31
PID 3032 wrote to memory of 1360	3032	5e63ce4976bca06c996c2aaaf3559b60.exe	31
PID 3032 wrote to memory of 1360	3032	5e63ce4976bca06c996c2aaaf3559b60.exe	31
PID 3032 wrote to memory of 1360	3032	5e63ce4976bca06c996c2aaaf3559b60.exe	31
PID 1360 wrote to memory of 1376	1360	msnssgr.exe	32
PID 1360 wrote to memory of 1376	1360	msnssgr.exe	32
PID 1360 wrote to memory of 1376	1360	msnssgr.exe	32
PID 1360 wrote to memory of 1376	1360	msnssgr.exe	32
PID 1376 wrote to memory of 2760	1376	cmd.exe	33
PID 1376 wrote to memory of 2760	1376	cmd.exe	33
PID 1376 wrote to memory of 2760	1376	cmd.exe	33
PID 1376 wrote to memory of 2760	1376	cmd.exe	33
PID 1360 wrote to memory of 3028	1360	msnssgr.exe	34
PID 1360 wrote to memory of 3028	1360	msnssgr.exe	34
PID 1360 wrote to memory of 3028	1360	msnssgr.exe	34
PID 1360 wrote to memory of 3028	1360	msnssgr.exe	34
PID 3028 wrote to memory of 2016	3028	msnssgr.exe	35
PID 3028 wrote to memory of 2016	3028	msnssgr.exe	35
PID 3028 wrote to memory of 2016	3028	msnssgr.exe	35
PID 3028 wrote to memory of 2016	3028	msnssgr.exe	35
PID 2016 wrote to memory of 776	2016	cmd.exe	36
PID 2016 wrote to memory of 776	2016	cmd.exe	36
PID 2016 wrote to memory of 776	2016	cmd.exe	36
PID 2016 wrote to memory of 776	2016	cmd.exe	36
PID 3028 wrote to memory of 1684	3028	msnssgr.exe	37
PID 3028 wrote to memory of 1684	3028	msnssgr.exe	37
PID 3028 wrote to memory of 1684	3028	msnssgr.exe	37
PID 3028 wrote to memory of 1684	3028	msnssgr.exe	37
PID 1684 wrote to memory of 2972	1684	msnssgr.exe	38
PID 1684 wrote to memory of 2972	1684	msnssgr.exe	38
PID 1684 wrote to memory of 2972	1684	msnssgr.exe	38
PID 1684 wrote to memory of 2972	1684	msnssgr.exe	38
PID 2972 wrote to memory of 1252	2972	cmd.exe	39
PID 2972 wrote to memory of 1252	2972	cmd.exe	39
PID 2972 wrote to memory of 1252	2972	cmd.exe	39
PID 2972 wrote to memory of 1252	2972	cmd.exe	39
PID 1684 wrote to memory of 2064	1684	msnssgr.exe	40
PID 1684 wrote to memory of 2064	1684	msnssgr.exe	40
PID 1684 wrote to memory of 2064	1684	msnssgr.exe	40
PID 1684 wrote to memory of 2064	1684	msnssgr.exe	40
PID 2064 wrote to memory of 1660	2064	msnssgr.exe	41
PID 2064 wrote to memory of 1660	2064	msnssgr.exe	41
PID 2064 wrote to memory of 1660	2064	msnssgr.exe	41
PID 2064 wrote to memory of 1660	2064	msnssgr.exe	41
PID 1660 wrote to memory of 1552	1660	cmd.exe	42
PID 1660 wrote to memory of 1552	1660	cmd.exe	42
PID 1660 wrote to memory of 1552	1660	cmd.exe	42
PID 1660 wrote to memory of 1552	1660	cmd.exe	42
PID 2064 wrote to memory of 2912	2064	msnssgr.exe	43
PID 2064 wrote to memory of 2912	2064	msnssgr.exe	43
PID 2064 wrote to memory of 2912	2064	msnssgr.exe	43
PID 2064 wrote to memory of 2912	2064	msnssgr.exe	43
PID 2912 wrote to memory of 1956	2912	msnssgr.exe	44
PID 2912 wrote to memory of 1956	2912	msnssgr.exe	44
PID 2912 wrote to memory of 1956	2912	msnssgr.exe	44
PID 2912 wrote to memory of 1956	2912	msnssgr.exe	44

C:\Users\Admin\AppData\Local\Temp\5e63ce4976bca06c996c2aaaf3559b60.exe
"C:\Users\Admin\AppData\Local\Temp\5e63ce4976bca06c996c2aaaf3559b60.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - Runs .reg file with regedit
    PID:716
- C:\Windows\SysWOW64\msnssgr.exe
  C:\Windows\system32\msnssgr.exe 532 "C:\Users\Admin\AppData\Local\Temp\5e63ce4976bca06c996c2aaaf3559b60.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\a.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:2760
- - C:\Windows\SysWOW64\msnssgr.exe
    C:\Windows\system32\msnssgr.exe 572 "C:\Windows\SysWOW64\msnssgr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:776
  - - C:\Windows\SysWOW64\msnssgr.exe
      C:\Windows\system32\msnssgr.exe 556 "C:\Windows\SysWOW64\msnssgr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1684
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1252
    - - C:\Windows\SysWOW64\msnssgr.exe
        
        C:\Windows\system32\msnssgr.exe 484 "C:\Windows\SysWOW64\msnssgr.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2064
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1552
      - C:\Windows\SysWOW64\msnssgr.exe
        
        C:\Windows\system32\msnssgr.exe 576 "C:\Windows\SysWOW64\msnssgr.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        7⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1856
        
        C:\Windows\SysWOW64\msnssgr.exe
        
        C:\Windows\system32\msnssgr.exe 580 "C:\Windows\SysWOW64\msnssgr.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:400
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        8⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2852
        
        C:\Windows\SysWOW64\msnssgr.exe
        
        C:\Windows\system32\msnssgr.exe 584 "C:\Windows\SysWOW64\msnssgr.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        9⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
558e454bc2d99d7949719cf24f540dd2

SHA1
e9c772bcee4ae780cdc28b0b4876385639e59b39

SHA256
677ec2cfe2ae99352aa12ac658d01a7bb0b51cf3cd2c568e94a78754326ca43a

SHA512
5bb10dcf81ccab0b7e2274d3ccdbda5a38014576096fef71725cfa6e16a4bfd29f481f3bc5ad15426fb9918eeca67fff11291a88caf10974433214674c1c1b64

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
ff6c57e8ec2b96b8da7fe900f1f3da1c

SHA1
a6f0dc2e2a0a46e1031017b81825173054bf76ae

SHA256
ad103027edabf24721c50018ae32c2b34872f7f63a352d31591a2cd7174008d6

SHA512
c0069e816bdf494c149e6bc278dc63ad58e348ec90d9bf161f2558bea03e9622e4b0c03b1a6b2517e87ef4e748d4aac36fb853f70180b55521e56c9c4960babc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
5bf31d7ea99b678c867ccdec344298aa

SHA1
2e548f54bf50d13993105c4f59bbeaeb87b17a68

SHA256
52be521b5509b444c0369ea7e69fc06b2d0b770cf600386c9a0178225ccdd281

SHA512
1bc82b65efe8c2be419748c8534210e7ad8cc8332ef87fb5df828eaebfdf630066ab3ad8d3ceeb82dee5ec4e680daff2748fcd4beaad8c71f1477b2ec7fe3564

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
851B

MD5
a13ff758fc4326eaa44582bc9700aead

SHA1
a4927b4a3b84526c5c42a077ade4652ab308f83f

SHA256
c0915178e63bf84c54e9c942b5cc80327c24d84125042767d7e1e2ef3e004588

SHA512
86c336086a1d0ca689e133df8e3c3ec83eeef86649dbf8b9d367c3e543358ad54f69d1a20d56c56200e294f22b2741186db0f359051159b4e670d3e9b5861842

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
a920eceddece6cf7f3487fd8e919af34

SHA1
a6dee2d31d4cbd1b18f5d3bc971521411a699889

SHA256
ec2d3952154412db3202f5c95e4d1b02c40a7f71f4458898ddc36e827a7b32d6

SHA512
a4700af2ce477c7ce33f434cdddd4031e88c3926d05475f522a753063269fe8b6e50b649c3e939272240194951cb70ac05df533978c19839e381141535275ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
117efa689c5631c1a1ee316f123182bd

SHA1
f477bf1e9f4db8452bd9fe314cd18715f7045689

SHA256
79ed2f9f9de900b4f0a4869fc5dd40f1dcfb11a3f50bd7a5f362b30fe51b52e7

SHA512
abe34afa94cca236205e9ea954b95a78c986612cebd847f5146f792c00a5c58ca1fdc55be2befd974b5be77b1b117e28d8c4996f34b41c78b653725f21da4671

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
d085cde42c14e8ee2a5e8870d08aee42

SHA1
c8e967f1d301f97dbcf252d7e1677e590126f994

SHA256
a15d5dfd655de1214e0aae2292ead17eef1f1b211d39fac03276bbd6325b0d9f

SHA512
de2cebd45d3cf053df17ae43466db6a8b2d816bf4b9a8deb5b577cfedf765b5dcdc5904145809ad3ca03ccff308f8893ec1faa309dd34afcab7cc1836d698d7b

Download Submit
C:\Windows\SysWOW64\msnssgr.exe

Filesize
115KB

MD5
e39976abee69567c96095f890571d296

SHA1
bb32795eeb4a14ccd77cde2fe8c80bf7329110a7

SHA256
843eeafc6ac3dc9d50f3e4d5088418b0a6f334e3f34a60033eab04e858e9c875

SHA512
7e3179ed1e98b345e229f74c7a6794742684ba6bc322744ad5d247e8b986641b7617bd230217681e1646f3f680177dbaead154a3c10a3a647de705ac06cd3996

Download Submit
C:\Windows\SysWOW64\msnssgr.exe

Filesize
124KB

MD5
2ad58e90f1073d912c8000cd470c845d

SHA1
d9279c1d433c24b37d19b0aa2ca96bd86b8739aa

SHA256
b084f6cf113cf57006453529c95ca3c363aeb5ae150ab573b2be0a652ce0c07f

SHA512
cddeee0d484cc44acf942448359e6b314e11bef0076c2452c641374df081cbf9ba3e10f7712c61c5434ca4065716d6b028d88784aa1b84154e4234c0ec5d1c7e

Download Submit
C:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\Windows\SysWOW64\msnssgr.exe

Filesize
404KB

MD5
5e63ce4976bca06c996c2aaaf3559b60

SHA1
23e42b447054455c3adca5e529ab614087e60ae1

SHA256
cb74efa5edabffa956e33282c67330c1926b8159486ad50f072d82fff34fe4f6

SHA512
eb3bd8782d03df6321c2682987c520b2fb9338c1fd4abbeaac1a355d971dafeaf6964e184cfb38ab3fa2a32d586012d62b952e806a6428fcc6669edb449f6c40

Download Submit
\Windows\SysWOW64\msnssgr.exe

Filesize
60KB

MD5
5838714868e9c1f75f6f70bde2828875

SHA1
89a4f227e0c1f3479161f1b05093c43aaa19539f

SHA256
458242518fbb56884315659109c68c0278359c2376911fd0882978d83b7127a3

SHA512
8184dbf0a1286123200afbcb95c4ddec4fd091f411090fad6fccb4bf492b6cc71ab254309b5718168b1498d967819142f8caba9b498b0c7097ef584c92a8ae05

Download Submit
\Windows\SysWOW64\msnssgr.exe

Filesize
154KB

MD5
548832116dfa12189ac69265dace2879

SHA1
2fff95b94cbce6a21884bc316b3000e1d448ef51

SHA256
cc109d1a52146bfdd0104984d06a2760439b51e42e8694d415cd65f8a3048f47

SHA512
ab9ecc65f2d30fd76bbe9e8fb5954a17138fc943015167e5927a2390e1754646cb9eb457dfe112a24c9eeeaa3796aed0f00dba98fa14c1d9f77d7e14d33ae1d0

Download Submit
\Windows\SysWOW64\msnssgr.exe

Filesize
108KB

MD5
f9f9e5ce4e784ab6dccf7a9e2765fc27

SHA1
1650305aaae5d84d85e15cc48edaaf082199c85d

SHA256
4eb0b9aafc9d7a79ca446678cc24d69b726fc4d1650583af655a558c8c03b14d

SHA512
ed06fce3b8b95d931a155193aca4a3dc6e9f05b29229a182007ca2cf34e91009a1c9017357eace4393fbf894f0bd1756349f7292cd26999f413fe66c1c4ebc06

Download Submit
\Windows\SysWOW64\msnssgr.exe

Filesize
114KB

MD5
a40f6c0f01638eb1ca59da3313cbcade

SHA1
9d8f3519d7512bcb3be0329de935d7b6f4e9422d

SHA256
0ab21c8c547f6e5ec1221b0c9c499f4830cbae461c213fd0e5e3f32a6d362057

SHA512
7a308437ea9fda5055dda599e0dd384706024899a3444db5c79dc7046ab5033ec5ae34a4143f4baf7a9f68f9e682fe505b85df9444c7cf43bc07f1755da5e214

Download Submit
memory/400-979-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1360-286-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Filesize
4KB

Download
memory/1360-288-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/1360-300-0x0000000003160000-0x0000000003161000-memory.dmp

Filesize
4KB

Download
memory/1360-299-0x0000000003170000-0x0000000003171000-memory.dmp

Filesize
4KB

Download
memory/1360-298-0x0000000003140000-0x0000000003141000-memory.dmp

Filesize
4KB

Download
memory/1360-297-0x0000000003150000-0x0000000003151000-memory.dmp

Filesize
4KB

Download
memory/1360-295-0x0000000003120000-0x0000000003121000-memory.dmp

Filesize
4KB

Download
memory/1360-293-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/1360-291-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/1360-290-0x0000000003090000-0x0000000003091000-memory.dmp

Filesize
4KB

Download
memory/1360-289-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1360-304-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1360-287-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Filesize
4KB

Download
memory/1360-251-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/1360-285-0x0000000002B50000-0x0000000002B51000-memory.dmp

Filesize
4KB

Download
memory/1360-284-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/1360-283-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Filesize
4KB

Download
memory/1360-281-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/1684-555-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1684-491-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/2064-682-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2064-695-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2912-816-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2912-827-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3028-308-0x0000000000390000-0x00000000003E0000-memory.dmp

Filesize
320KB

Download
memory/3028-302-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3028-432-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3028-433-0x0000000000390000-0x00000000003E0000-memory.dmp

Filesize
320KB

Download
memory/3028-428-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3028-423-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/3028-425-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/3028-426-0x0000000002B50000-0x0000000002B51000-memory.dmp

Filesize
4KB

Download
memory/3028-427-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/3028-315-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/3028-307-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3028-306-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/3028-303-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/3028-305-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/3032-26-0x0000000002B10000-0x0000000002B15000-memory.dmp

Filesize
20KB

Download
memory/3032-172-0x0000000000270000-0x00000000002C0000-memory.dmp

Filesize
320KB

Download
memory/3032-11-0x0000000002B20000-0x0000000002B24000-memory.dmp

Filesize
16KB

Download
memory/3032-17-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/3032-18-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3032-20-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/3032-21-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3032-24-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/3032-44-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3032-25-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/3032-27-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3032-28-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/3032-29-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/3032-30-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/3032-0-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3032-31-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/3032-32-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/3032-33-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3032-35-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3032-10-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/3032-42-0x0000000000270000-0x00000000002C0000-memory.dmp

Filesize
320KB

Download
memory/3032-164-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3032-43-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3032-22-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/3032-23-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3032-19-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/3032-16-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/3032-12-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/3032-13-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/3032-15-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/3032-14-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/3032-9-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/3032-8-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/3032-7-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/3032-4-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3032-6-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3032-5-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/3032-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3032-2-0x0000000000270000-0x00000000002C0000-memory.dmp

Filesize
320KB

Download
memory/3032-1-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads