lumma | cfea041c1b52d5ee35b84674fb3684b068b2f2811c8ccf454c42fd878b1dd999

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7ddafb89dd471d26c8a358f74c45361.exe
Size 109KB
Sample240314-grd35aee52
SHA256 cfea041c1b52d5ee35b84674fb3684b068b2f2811c8ccf454c42fd878b1dd999
MD5 c7ddafb89dd471d26c8a358f74c45361
SHA1 2976c33c7f86fc798396b6472fb182d9b9ecd0cd
SHA512 2d23cb4947e6fa3477316b37bf2063b1627f2c07b50bba5b95ac16fd4136ef70b7201d76c08362365e61f84d309735fb93ac68df8173080f80bbf0470785da10
SSDEEP 1536:CVNKvlIOvAimp6NZTsFTLSelpqwoC9VPZZSkvogrsN1PYgJOLpv2d9kBF:heOlmp6T01YCPZZ9voi01Yjpv2dK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma aspackv2 evasion stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 11 IoCs

resource	yara_rule
behavioral2/memory/2992-226-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/1524-227-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/3996-340-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/3064-453-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/1256-566-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/3860-679-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/4896-792-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/640-905-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/3688-1018-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/5096-1131-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4
behavioral2/memory/4716-1244-0x0000000000400000-0x000000000051B000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies security service 2 TTPs 22 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001e980-114.dat	aspack_v212_v242

Executes dropped EXE 10 IoCs

pid	Process
1524	scvhost.exe
3996	scvhost.exe
3064	scvhost.exe
1256	scvhost.exe
3860	scvhost.exe
4896	scvhost.exe
640	scvhost.exe
3688	scvhost.exe
5096	scvhost.exe
4716	scvhost.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	c7ddafb89dd471d26c8a358f74c45361.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	c7ddafb89dd471d26c8a358f74c45361.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe

Runs .reg file with regedit 11 IoCs

pid	Process
4248	regedit.exe
1204	regedit.exe
4808	regedit.exe
3988	regedit.exe
4820	regedit.exe
4820	regedit.exe
4420	regedit.exe
4832	regedit.exe
3084	regedit.exe
2088	regedit.exe
1464	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3084	2992	c7ddafb89dd471d26c8a358f74c45361.exe	89
PID 2992 wrote to memory of 3084	2992	c7ddafb89dd471d26c8a358f74c45361.exe	89
PID 2992 wrote to memory of 3084	2992	c7ddafb89dd471d26c8a358f74c45361.exe	89
PID 3084 wrote to memory of 2088	3084	cmd.exe	90
PID 3084 wrote to memory of 2088	3084	cmd.exe	90
PID 3084 wrote to memory of 2088	3084	cmd.exe	90
PID 2992 wrote to memory of 1524	2992	c7ddafb89dd471d26c8a358f74c45361.exe	91
PID 2992 wrote to memory of 1524	2992	c7ddafb89dd471d26c8a358f74c45361.exe	91
PID 2992 wrote to memory of 1524	2992	c7ddafb89dd471d26c8a358f74c45361.exe	91
PID 1524 wrote to memory of 536	1524	scvhost.exe	92
PID 1524 wrote to memory of 536	1524	scvhost.exe	92
PID 1524 wrote to memory of 536	1524	scvhost.exe	92
PID 536 wrote to memory of 1464	536	cmd.exe	93
PID 536 wrote to memory of 1464	536	cmd.exe	93
PID 536 wrote to memory of 1464	536	cmd.exe	93
PID 1524 wrote to memory of 3996	1524	scvhost.exe	104
PID 1524 wrote to memory of 3996	1524	scvhost.exe	104
PID 1524 wrote to memory of 3996	1524	scvhost.exe	104
PID 3996 wrote to memory of 1224	3996	scvhost.exe	105
PID 3996 wrote to memory of 1224	3996	scvhost.exe	105
PID 3996 wrote to memory of 1224	3996	scvhost.exe	105
PID 1224 wrote to memory of 4808	1224	cmd.exe	106
PID 1224 wrote to memory of 4808	1224	cmd.exe	106
PID 1224 wrote to memory of 4808	1224	cmd.exe	106
PID 3996 wrote to memory of 3064	3996	scvhost.exe	109
PID 3996 wrote to memory of 3064	3996	scvhost.exe	109
PID 3996 wrote to memory of 3064	3996	scvhost.exe	109
PID 3064 wrote to memory of 4800	3064	scvhost.exe	110
PID 3064 wrote to memory of 4800	3064	scvhost.exe	110
PID 3064 wrote to memory of 4800	3064	scvhost.exe	110
PID 4800 wrote to memory of 3988	4800	cmd.exe	111
PID 4800 wrote to memory of 3988	4800	cmd.exe	111
PID 4800 wrote to memory of 3988	4800	cmd.exe	111
PID 3064 wrote to memory of 1256	3064	scvhost.exe	113
PID 3064 wrote to memory of 1256	3064	scvhost.exe	113
PID 3064 wrote to memory of 1256	3064	scvhost.exe	113
PID 1256 wrote to memory of 4452	1256	scvhost.exe	114
PID 1256 wrote to memory of 4452	1256	scvhost.exe	114
PID 1256 wrote to memory of 4452	1256	scvhost.exe	114
PID 4452 wrote to memory of 4248	4452	cmd.exe	115
PID 4452 wrote to memory of 4248	4452	cmd.exe	115
PID 4452 wrote to memory of 4248	4452	cmd.exe	115
PID 1256 wrote to memory of 3860	1256	scvhost.exe	116
PID 1256 wrote to memory of 3860	1256	scvhost.exe	116
PID 1256 wrote to memory of 3860	1256	scvhost.exe	116
PID 3860 wrote to memory of 880	3860	scvhost.exe	117
PID 3860 wrote to memory of 880	3860	scvhost.exe	117
PID 3860 wrote to memory of 880	3860	scvhost.exe	117
PID 880 wrote to memory of 4820	880	cmd.exe	118
PID 880 wrote to memory of 4820	880	cmd.exe	118
PID 880 wrote to memory of 4820	880	cmd.exe	118
PID 3860 wrote to memory of 4896	3860	scvhost.exe	121
PID 3860 wrote to memory of 4896	3860	scvhost.exe	121
PID 3860 wrote to memory of 4896	3860	scvhost.exe	121
PID 4896 wrote to memory of 1696	4896	scvhost.exe	122
PID 4896 wrote to memory of 1696	4896	scvhost.exe	122
PID 4896 wrote to memory of 1696	4896	scvhost.exe	122
PID 1696 wrote to memory of 4820	1696	cmd.exe	123
PID 1696 wrote to memory of 4820	1696	cmd.exe	123
PID 1696 wrote to memory of 4820	1696	cmd.exe	123
PID 4896 wrote to memory of 640	4896	scvhost.exe	124
PID 4896 wrote to memory of 640	4896	scvhost.exe	124
PID 4896 wrote to memory of 640	4896	scvhost.exe	124
PID 640 wrote to memory of 3552	640	scvhost.exe	125

C:\Users\Admin\AppData\Local\Temp\c7ddafb89dd471d26c8a358f74c45361.exe
"C:\Users\Admin\AppData\Local\Temp\c7ddafb89dd471d26c8a358f74c45361.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - Runs .reg file with regedit
    PID:2088
- C:\Windows\SysWOW64\scvhost.exe
  C:\Windows\system32\scvhost.exe 1164 "C:\Users\Admin\AppData\Local\Temp\c7ddafb89dd471d26c8a358f74c45361.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\a.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:1464
- - C:\Windows\SysWOW64\scvhost.exe
    C:\Windows\system32\scvhost.exe 1168 "C:\Windows\SysWOW64\scvhost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\a.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1224
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4808
  - - C:\Windows\SysWOW64\scvhost.exe
      C:\Windows\system32\scvhost.exe 1140 "C:\Windows\SysWOW64\scvhost.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4800
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:3988
    - - C:\Windows\SysWOW64\scvhost.exe
        
        C:\Windows\system32\scvhost.exe 1144 "C:\Windows\SysWOW64\scvhost.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1256
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4248
      - C:\Windows\SysWOW64\scvhost.exe
        
        C:\Windows\system32\scvhost.exe 1136 "C:\Windows\SysWOW64\scvhost.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4820
        
        C:\Windows\SysWOW64\scvhost.exe
        
        C:\Windows\system32\scvhost.exe 1152 "C:\Windows\SysWOW64\scvhost.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4820
        
        C:\Windows\SysWOW64\scvhost.exe
        
        C:\Windows\system32\scvhost.exe 1160 "C:\Windows\SysWOW64\scvhost.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        9⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4420
        
        C:\Windows\SysWOW64\scvhost.exe
        
        C:\Windows\system32\scvhost.exe 1156 "C:\Windows\SysWOW64\scvhost.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        10⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1204
        
        C:\Windows\SysWOW64\scvhost.exe
        
        C:\Windows\system32\scvhost.exe 1148 "C:\Windows\SysWOW64\scvhost.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        11⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4832
        
        C:\Windows\SysWOW64\scvhost.exe
        
        C:\Windows\system32\scvhost.exe 1176 "C:\Windows\SysWOW64\scvhost.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        12⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:3084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 784B
SHA256 8cd3b8dd28ac014cf973d9ab4b03af1c274bbc9b5ee0ee4ab8af0bdb01573b84
MD5 5a466127fedf6dbcd99adc917bd74581
SHA1 a2e60b101c8789b59360d95a64ec07d0723c4d38
SHA512 695cafc932bc8f0a514bc515860cb275297665de63ca3394b55f42c457761ebf654d29d504674681a77b34e3356a469e8c5b97ff7efc24de330d5375f025cba5
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 703B
SHA256 68e8d8ef14bfbe96ebad3fb391fd4c1e57068a7f950dd31840884f6d58b078a8
MD5 e2564fc59a86ea85b7485ab7288c68c4
SHA1 bc1544d9a03d1adafe399067ac32bf8d1cedbdb0
SHA512 e09c6741d99ec41763e939aa39adb4e0f8508d37556c52251eec268849e85960da42ace7e9b82f1927de5bcf29ebec205189b113d2bb123025f3e6615b28ff0a
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 1KB
SHA256 6646122747280612f7cb0e88c16544e472aae7c20217b711bbee8f10562e49c7
MD5 f1cbbc2ce0d93c45a92edcc86780e9f0
SHA1 d893306caae2584cdeba4c80c3bfe18548fa227a
SHA512 b4ba834ab846d1dc9bbeca52e54705cdbf010687a5c1c54a82fddc15c64025528ef874213a59d1be5fb7ada7abd0862235a0c924f10819fbbfb36bd2ba29adf7
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 1KB
SHA256 0696a5c075674c13128a61fd02c3be39c68860dc24f3669415817d03c75415c6
MD5 82fb85e6f9058c36d57abc2350ffee7e
SHA1 f52708d066380d42924513f697ab4ed5492f78b8
SHA512 27c84e21ed39cc0ff6377d717b99ee444867eba7a74b878b30c8a7ec7df97003f02963399020abe09a73f4b6949c75580eb85067412f4ccdacc03e8caf5d966a
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 1KB
SHA256 ec2d3952154412db3202f5c95e4d1b02c40a7f71f4458898ddc36e827a7b32d6
MD5 a920eceddece6cf7f3487fd8e919af34
SHA1 a6dee2d31d4cbd1b18f5d3bc971521411a699889
SHA512 a4700af2ce477c7ce33f434cdddd4031e88c3926d05475f522a753063269fe8b6e50b649c3e939272240194951cb70ac05df533978c19839e381141535275ecc
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 9697ec584ef188873daa789eb779bb95dd3efa2c4c98a55dffa30cac4d156c14
MD5 5575ef034e791d4d3b09da6c0c4ee764
SHA1 50a0851ddf4b0c4014ad91f976e953baffe30951
SHA512 ecf52614d3a16d8e558751c799fde925650ef3e6d254d172217e1b0ed76a983d45b74688616d3e3432a16cec98b986b17eaecd319a18df9a67e4d47f17380756
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 208B
SHA256 2ac5bd7466724458c6f36bbbe6be697bfbc95d3b8f8ad486b83d595bd295dbc3
MD5 67a0c98a371995d5434cb9788ee1c42f
SHA1 7171d3dca52f038ca9d9e8b13f356462dbc8f3cc
SHA512 f5b31a9e68044db25853f9a158dd4ff1da717beb5802dd11a6d3b705b5bf065304c98df3c81c8487e922d4f94690ecfb2662077bffb50cba036bcd8e50935191
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 088881ff28ef1240847decd884be366614865bf9660f862dbffa64d504467aea
MD5 61ec72543aaac5c7b336d2b22f919c07
SHA1 5bddb1f73b24c2113e9bf8268640f75fb0f3bd8d
SHA512 e8ed6c1813218a542e0449f6bcda47b9464f2445a5d4b20e20b657d5328eb9fd5ddf859e61794a0b3d32057590ac029064c078d5743fe1a316ca8fdf254f7f62
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 1KB
SHA256 e615959931f345e611ac44be7534d697c1495c641d13e50ae919a7807c8ff008
MD5 e2d37af73d5fe4a504db3f8c0d560e3d
SHA1 88c6bf5b485dd9c79283ccb5d2546ffbb95e563d
SHA512 8cb17131326361071a3ae2997cdfaa316ce10c481f48af23fa526380daffa39b2538251cbaa4cf3bd9a9c0014a9184be5a13a44cf45fb93591ba3180670ddb89
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 1KB
SHA256 13dc8dc70b7bb240f6f4cf6be5ff0ec55c606267a328bb9c9e34e5fa70cce0d9
MD5 bf7ee07851e04b2a0dbe554db62dc3aa
SHA1 cad155b66053cd7ce2b969a0eb20a8f4812b1f46
SHA512 9ed79305c81287cf01d0138d87c6ec981b5bdd9195c56f8def4c74fdbc9b4816661d084fc1314f99b40102945b61d05121f4eaadec6403d4295a80847b797bc4
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 76ee7c489d11427af94d0334368ef2ed44df4a74984ffd4022c9ea9fae9c41fb
MD5 f8a9a1aa9bab7821d25ae628e6d04f68
SHA1 c3e7a9ccc9805ae94aabfd16e2cb461fde3fae5a
SHA512 0fb3a29367fa3c3eb36c6a7e9ff217ccdd7cce18309964aa7068a00f500ea4ea49588344ebbc52ae77d83e5042c3fdb84f56fa1dae07b8bb774aed6fffd18c0a
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 182B
SHA256 f827e79f717d490ba61a9ec5f8198ebc3066e22fd25871f06ce15f04162f57b9
MD5 09e45f09a25fed7995c8430f4a370ade
SHA1 fc49fec86e600a7c4e1b6bfa274f883635d65687
SHA512 1a6ed68eced45f30fff3f281ceb082d6ae9e13bc71f6f7da5b4ba064e9876ef7efd76eaffe1325f6e3dfa3a5429200302ea84915245f26ac393105fd1ec365ad
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 0db388471ad17c9c9b4a0a40b2536b7a6f27b8cc96775812d48d7009acb418c0
MD5 54ca6e3ef1c12b994043e85a8c9895f0
SHA1 5eaccfb482cbe24cf5c3203ffdc926184097427e
SHA512 925615f057558a00fb0ed3f9faeee2b70f3dd5469376de9381a387b3666c230fc0bb5b83fd3acf0169872e3c5f747cbdaff473d7fa389a5848f3828916680626
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e
MD5 9e5db93bd3302c217b15561d8f1e299d
SHA1 95a5579b336d16213909beda75589fd0a2091f30
SHA512 b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 79ed2f9f9de900b4f0a4869fc5dd40f1dcfb11a3f50bd7a5f362b30fe51b52e7
MD5 117efa689c5631c1a1ee316f123182bd
SHA1 f477bf1e9f4db8452bd9fe314cd18715f7045689
SHA512 abe34afa94cca236205e9ea954b95a78c986612cebd847f5146f792c00a5c58ca1fdc55be2befd974b5be77b1b117e28d8c4996f34b41c78b653725f21da4671
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 431B
SHA256 7ff65c0be2004867f536ce9b94783da4b5e4bc06cca5bd899933c8b68a44c705
MD5 9fa547ff360b09f7e093593af0b5a13b
SHA1 9debc99bb7450f59a7b09f16c0393e5c7a955ba4
SHA512 30e5aa130c6b0869dc3fbb79da54d42699be6de0af65c9127ea047548a22d98b68300f18432141207166687576ba86433d4ae9d3458dbcc2aec9f14198c58193
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 574B
SHA256 a123ebc1fac86713cdd7c4a511e022783a581ea02ba65ea18360555706ae5f2d
MD5 5020988c301a6bf0c54a293ddf64837c
SHA1 5b65e689a2988b9a739d53565b2a847f20d70f09
SHA512 921a07597f8c82c65c675f5b09a2552c7e2e8c65c8df59eebbe9aff0bfe439ad93f5efc97ba521be31299323051d61ead6a3f0be27302dc0f728b7a844fb2fcf
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 f3bb35f7fc756da2c2297a100fa29506cb12371edb793061add90ee16318bf03
MD5 fa83299c5a0d8714939977af6bdafa92
SHA1 46a4abab9b803a7361ab89d0ca000a367550e23c
SHA512 85e46b9f1089054e60c433459eea52bec26330f8b91879df3b48db1533a307443dd82006ac3bb86245bbd207c1d8c75c29949f755cc0dc262ede888a1d531599
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 a15d5dfd655de1214e0aae2292ead17eef1f1b211d39fac03276bbd6325b0d9f
MD5 d085cde42c14e8ee2a5e8870d08aee42
SHA1 c8e967f1d301f97dbcf252d7e1677e590126f994
SHA512 de2cebd45d3cf053df17ae43466db6a8b2d816bf4b9a8deb5b577cfedf765b5dcdc5904145809ad3ca03ccff308f8893ec1faa309dd34afcab7cc1836d698d7b
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 10732e2612780d9694faf0bb9b27cdc6f3376ad327da7dfc346e9e5579493d33
MD5 1daa413d1a8cd1692f2e4ae22b54c74a
SHA1 2e02e2a23cfaa62f301e29a117e291ff93cc5d31
SHA512 b947c70c7c4af971e3fbdc66fb7175b6624ac68c6a723dac7ecb5cf5f43bbe210fa0fa61fd4b6153dccf7de077d003ca03f061e209dc37773546b038e6aef277
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 10546433db0c1ab764cd632eb0d08d93a530c6e52d1ec7fcb9c1fd32193f2a9c
MD5 cd085b8c40e69c2bf1eb3d59f8155b99
SHA1 3499260f24020fe6d54d9d632d34ba2770bb06e0
SHA512 3813b8a7f742f6a64da36492447f3f2fee6ea505d7d0dccebede84117ec06101321dfacc7901403ea557171085982ae1a4dc39dd666da9e67d61ea71dfbb8edb
MD5 SHA1 SHA512

Submit Download

scvhost.exe

Path C:\Windows\SysWOW64\scvhost.exe
Size 109KB
SHA256 cfea041c1b52d5ee35b84674fb3684b068b2f2811c8ccf454c42fd878b1dd999
MD5 c7ddafb89dd471d26c8a358f74c45361
SHA1 2976c33c7f86fc798396b6472fb182d9b9ecd0cd
SHA512 2d23cb4947e6fa3477316b37bf2063b1627f2c07b50bba5b95ac16fd4136ef70b7201d76c08362365e61f84d309735fb93ac68df8173080f80bbf0470785da10
SSDEEP 1536:CVNKvlIOvAimp6NZTsFTLSelpqwoC9VPZZSkvogrsN1PYgJOLpv2d9kBF:heOlmp6T01YCPZZ9voi01Yjpv2dK
MD5 SHA1 SHA512 SSDEEP

Submit Download

a.bat

Path \??\c:\a.bat
Size 5KB
SHA256 ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876
MD5 0019a0451cc6b9659762c3e274bc04fb
SHA1 5259e256cc0908f2846e532161b989f1295f479b
SHA512 314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904
SSDEEP 96:riZ6ie0DiQDiVDiVsHQi7NifhbR/i2OjOpiAqWr2vKV+A2gp6rmP2L9MCIMdwvbA:HGGSaaxb32O1iczC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/640-905-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1256-566-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1524-227-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2992-226-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/3064-453-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/3688-1018-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/3860-679-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/3996-340-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/4716-1244-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/4896-792-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/5096-1131-0x0000000000400000-0x000000000051B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads