Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-03-2024 07:50

General

  • Target

    6c29dea6d4c5d95020f3cbe29942620dc2bbbd86919b503af79bb896aaf9b867.exe

  • Size

    1.8MB

  • MD5

    fdd4f443fe3a3a9ce9c78cd853611ade

  • SHA1

    14921ff59645bbd211120133b5483bdd3a688b5f

  • SHA256

    6c29dea6d4c5d95020f3cbe29942620dc2bbbd86919b503af79bb896aaf9b867

  • SHA512

    948f6c23e8b600f3bfe6c0ac7874221d2f8146b36f3243a5d2a3a61f5e6dc88b7688089e4940efb81f71cdfe99de20398a4346ef3894c085e265078dd6459d00

  • SSDEEP

    49152:d+7cL4d1Nhm+CzXmXqQeRcZCVlVF6BZMAwqw/2cZfg:deFK+CFRckVlVsBF9C1

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

lumma

C2

https://associationokeo.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 8 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c29dea6d4c5d95020f3cbe29942620dc2bbbd86919b503af79bb896aaf9b867.exe
    "C:\Users\Admin\AppData\Local\Temp\6c29dea6d4c5d95020f3cbe29942620dc2bbbd86919b503af79bb896aaf9b867.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Users\Admin\AppData\Local\Temp\1000022001\fdfd53ab62.exe
        "C:\Users\Admin\AppData\Local\Temp\1000022001\fdfd53ab62.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:1172
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
          PID:2628
        • C:\Users\Admin\AppData\Local\Temp\1000034001\lumma21.exe
          "C:\Users\Admin\AppData\Local\Temp\1000034001\lumma21.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of FindShellTrayWindow
          PID:2384
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:556
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
            4⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4564
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              5⤵
                PID:3648
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\172592802658_Desktop.zip' -CompressionLevel Optimal
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3644
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
            3⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            PID:2524
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:4296
      • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
        C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3104
        • C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe
          "C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          PID:1904
        • C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe
          "C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2512
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4216
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 932
                4⤵
                • Program crash
                PID:4300
          • C:\Users\Admin\AppData\Local\Temp\1000068001\ISetup3.exe
            "C:\Users\Admin\AppData\Local\Temp\1000068001\ISetup3.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Users\Admin\AppData\Local\Temp\u1m8.0.exe
              "C:\Users\Admin\AppData\Local\Temp\u1m8.0.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:3012
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GCFIIEBKEG.exe"
                4⤵
                  PID:1880
                  • C:\Users\Admin\AppData\Local\Temp\GCFIIEBKEG.exe
                    "C:\Users\Admin\AppData\Local\Temp\GCFIIEBKEG.exe"
                    5⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    PID:3736
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\GCFIIEBKEG.exe
                      6⤵
                        PID:2172
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 2.2.2.2 -n 1 -w 3000
                          7⤵
                          • Runs ping.exe
                          PID:960
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 2328
                    4⤵
                    • Program crash
                    PID:2788
                • C:\Users\Admin\AppData\Local\Temp\u1m8.1.exe
                  "C:\Users\Admin\AppData\Local\Temp\u1m8.1.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1804
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2976
                    • C:\Windows\SysWOW64\chcp.com
                      chcp 1251
                      5⤵
                        PID:4944
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                        5⤵
                        • Creates scheduled task(s)
                        PID:4396
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1272
                    3⤵
                    • Program crash
                    PID:540
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                  2⤵
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:452
                  • C:\Windows\system32\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                    3⤵
                    • Blocklisted process makes network request
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3576
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show profiles
                      4⤵
                        PID:2524
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\172592802658_Desktop.zip' -CompressionLevel Optimal
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2192
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                    2⤵
                    • Blocklisted process makes network request
                    • Loads dropped DLL
                    PID:1720
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4216 -ip 4216
                  1⤵
                    PID:1428
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2096 -ip 2096
                    1⤵
                      PID:3876
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3032 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:3
                      1⤵
                        PID:4092
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3012 -ip 3012
                        1⤵
                          PID:3416
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
                          1⤵
                            PID:372
                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3876
                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4584

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\Are.docx

                            Filesize

                            11KB

                            MD5

                            a33e5b189842c5867f46566bdbf7a095

                            SHA1

                            e1c06359f6a76da90d19e8fd95e79c832edb3196

                            SHA256

                            5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                            SHA512

                            f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                          • C:\ProgramData\mozglue.dll

                            Filesize

                            593KB

                            MD5

                            c8fd9be83bc728cc04beffafc2907fe9

                            SHA1

                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                            SHA256

                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                            SHA512

                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          • C:\ProgramData\nss3.dll

                            Filesize

                            2.0MB

                            MD5

                            1cc453cdf74f31e4d913ff9c10acdde2

                            SHA1

                            6e85eae544d6e965f15fa5c39700fa7202f3aafe

                            SHA256

                            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                            SHA512

                            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                            Filesize

                            3KB

                            MD5

                            fe3aab3ae544a134b68e881b82b70169

                            SHA1

                            926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                            SHA256

                            bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                            SHA512

                            3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

                            Filesize

                            40B

                            MD5

                            20d4b8fa017a12a108c87f540836e250

                            SHA1

                            1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                            SHA256

                            6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                            SHA512

                            507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Filesize

                            1KB

                            MD5

                            2730b7b80e5162a8019025bbea798685

                            SHA1

                            69b6904d93ad582be522851e1b138c7b6fbcc0ed

                            SHA256

                            f4365abd73df4d70be9dcc12dc128f8ad504add56e13b2e245ccadd4322a7290

                            SHA512

                            d00ad4fdd762dba4babc8222c6b3a7747a67bf708abe6e5dba06378a88ad7312e69b1987896439f43fb652a0b71afec511b3e7cb4d9d43d92659632015da5771

                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

                            Filesize

                            1.8MB

                            MD5

                            fdd4f443fe3a3a9ce9c78cd853611ade

                            SHA1

                            14921ff59645bbd211120133b5483bdd3a688b5f

                            SHA256

                            6c29dea6d4c5d95020f3cbe29942620dc2bbbd86919b503af79bb896aaf9b867

                            SHA512

                            948f6c23e8b600f3bfe6c0ac7874221d2f8146b36f3243a5d2a3a61f5e6dc88b7688089e4940efb81f71cdfe99de20398a4346ef3894c085e265078dd6459d00

                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

                            Filesize

                            1.8MB

                            MD5

                            ad1abf08dcb6b6b974bdc7a940478136

                            SHA1

                            7a6079a57271079d4b73b21587096b749bbaa647

                            SHA256

                            8ddbfb53d32bce4f79284b8c7502c7852c9d752c36d69d596b33e785f0ce426c

                            SHA512

                            3cd577228c8db7cdf24865655ba12c4cbef59cd90672a3a12df3c99dbde34d3f66c8b3f7a6fc3c86d5959f4bafa77411ba6cb568a3a316969e7540cf793eb14c

                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

                            Filesize

                            1.5MB

                            MD5

                            091b5c36141d745d65201f486e77ec60

                            SHA1

                            152c9a1a249c62eef7958892abf78316ad5e298d

                            SHA256

                            ba4056fd11a77fcc7c4105a5dfe567be8f39d1312b6cff08e47cfc5a9e276f81

                            SHA512

                            0f403ad6f74599f23f7ec3df3133f1ae4e500e86a6b264464e6adfe8786f9c53a5878a70c8f97d56b16a4ebae4885bd2a91b31c338ab5c671819c1bac2397f0f

                          • C:\Users\Admin\AppData\Local\Temp\1000022001\fdfd53ab62.exe

                            Filesize

                            2.9MB

                            MD5

                            3f05514266ac9f3cf9e296c81bb9606e

                            SHA1

                            7cf7d86cf5141c0a08d63789d2a1d2fec1a25707

                            SHA256

                            c19bc0e2529a74d56b6f1d3b4d654ed21e8eca5e5d27cec395948b6849b1e017

                            SHA512

                            3c7a746c2ae697594d2d02bcd18228b9153c1fb2229e8d779eac4e0abc8f46d74f8a0beeebfb1a9f0cb3c496e369ce32a8c5a4e97947dc0c4740a7ef19b1b139

                          • C:\Users\Admin\AppData\Local\Temp\1000034001\lumma21.exe

                            Filesize

                            413KB

                            MD5

                            d467222c3bd563cb72fa49302f80b079

                            SHA1

                            9335e2a36abb8309d8a2075faf78d66b968b2a91

                            SHA256

                            fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

                            SHA512

                            484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

                          • C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe

                            Filesize

                            350KB

                            MD5

                            04df085b57814d1a1accead4e153909e

                            SHA1

                            6d277da314ef185ba9072a9b677b599b1f46c35b

                            SHA256

                            91a36d137ebfa812b055728807e11338d15d3a5d869cb4babdf779266688e4dd

                            SHA512

                            f37678424e46e4f28e1047161db60ad737515558c8c8905ed598ca96b198304da7356e49e7bb9d1e77fe75372f0b5a7f670a353d093749c37bb85c40ec7fdafa

                          • C:\Users\Admin\AppData\Local\Temp\1000068001\ISetup3.exe

                            Filesize

                            463KB

                            MD5

                            03e0068c6975aa0eaaa3b559cdd447cc

                            SHA1

                            adfbb0004d15938e69d1493aa8130f13e8860900

                            SHA256

                            51fae2110c1cca5dc24e6d12ddf0f9e752254e8af9d7e1014b1975ddaff86649

                            SHA512

                            47049d342f05cc6c57e89b1323c7c4d64f8e1414374ba903dd0c836c36d7a4def0affae507b7d312d308a8d0ce68234236e7c045186cec7568faf92422f1daa5

                          • C:\Users\Admin\AppData\Local\Temp\GCFIIEBKEG.exe

                            Filesize

                            106KB

                            MD5

                            fe380780b5c35bd6d54541791151c2be

                            SHA1

                            7fe3a583cf91474c733f85cebf3c857682e269e1

                            SHA256

                            b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                            SHA512

                            ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ojnwv1ts.25r.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Users\Admin\AppData\Local\Temp\u1m8.0.exe

                            Filesize

                            319KB

                            MD5

                            9d94b92e75d5fcc69a5a18309e636e61

                            SHA1

                            e22535b78694ba6872db4d522e9eb50187125f13

                            SHA256

                            39f2b667c53d8e7626d9e8a581802f255b2ee388a1de4bb4293db4202abc1faf

                            SHA512

                            d8ef5452af1f3f02c9e5619a4be4a865fac228fcb3ce323d47e3df67d6a30778c24925a6047a90db283cbf4a32fc091718b570984683105dbfe11d8d9fb016ce

                          • C:\Users\Admin\AppData\Local\Temp\u1m8.1.exe

                            Filesize

                            1.7MB

                            MD5

                            eee5ddcffbed16222cac0a1b4e2e466e

                            SHA1

                            28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

                            SHA256

                            2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

                            SHA512

                            8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

                          • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

                            Filesize

                            128B

                            MD5

                            11bb3db51f701d4e42d3287f71a6a43e

                            SHA1

                            63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                            SHA256

                            6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                            SHA512

                            907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                          • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                            Filesize

                            109KB

                            MD5

                            726cd06231883a159ec1ce28dd538699

                            SHA1

                            404897e6a133d255ad5a9c26ac6414d7134285a2

                            SHA256

                            12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                            SHA512

                            9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                          • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                            Filesize

                            1.2MB

                            MD5

                            15a42d3e4579da615a384c717ab2109b

                            SHA1

                            22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                            SHA256

                            3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                            SHA512

                            1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                          • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                            Filesize

                            109KB

                            MD5

                            154c3f1334dd435f562672f2664fea6b

                            SHA1

                            51dd25e2ba98b8546de163b8f26e2972a90c2c79

                            SHA256

                            5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                            SHA512

                            1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                          • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                            Filesize

                            1.2MB

                            MD5

                            f35b671fda2603ec30ace10946f11a90

                            SHA1

                            059ad6b06559d4db581b1879e709f32f80850872

                            SHA256

                            83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                            SHA512

                            b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                          • memory/1172-54-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-174-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-442-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-401-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-180-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-53-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-406-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-429-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-338-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-410-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-414-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-438-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1172-434-0x0000000000EA0000-0x000000000123B000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1804-220-0x0000000000400000-0x0000000000930000-memory.dmp

                            Filesize

                            5.2MB

                          • memory/1804-360-0x0000000000400000-0x0000000000930000-memory.dmp

                            Filesize

                            5.2MB

                          • memory/1804-227-0x00000000027F0000-0x00000000027F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1904-413-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-409-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-382-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-428-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-110-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-295-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-130-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-404-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-441-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-226-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-433-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-219-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/1904-437-0x0000000000730000-0x0000000000ACB000-memory.dmp

                            Filesize

                            3.6MB

                          • memory/2096-176-0x0000000000DD0000-0x0000000000ED0000-memory.dmp

                            Filesize

                            1024KB

                          • memory/2096-177-0x0000000000400000-0x0000000000B1D000-memory.dmp

                            Filesize

                            7.1MB

                          • memory/2096-178-0x0000000000CE0000-0x0000000000D4E000-memory.dmp

                            Filesize

                            440KB

                          • memory/2096-231-0x0000000000400000-0x0000000000B1D000-memory.dmp

                            Filesize

                            7.1MB

                          • memory/2192-306-0x000002A7B2E70000-0x000002A7B2E80000-memory.dmp

                            Filesize

                            64KB

                          • memory/2192-296-0x00007FFAD8B40000-0x00007FFAD9601000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/2512-140-0x0000000072870000-0x0000000073020000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/2512-169-0x0000000002EC0000-0x0000000004EC0000-memory.dmp

                            Filesize

                            32.0MB

                          • memory/2512-132-0x0000000000A30000-0x0000000000A8E000-memory.dmp

                            Filesize

                            376KB

                          • memory/2512-131-0x0000000072870000-0x0000000073020000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/2548-80-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-31-0x0000000004E20000-0x0000000004E21000-memory.dmp

                            Filesize

                            4KB

                          • memory/2548-28-0x0000000004E30000-0x0000000004E31000-memory.dmp

                            Filesize

                            4KB

                          • memory/2548-26-0x0000000004E40000-0x0000000004E41000-memory.dmp

                            Filesize

                            4KB

                          • memory/2548-33-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2548-34-0x0000000004E90000-0x0000000004E91000-memory.dmp

                            Filesize

                            4KB

                          • memory/2548-379-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-29-0x0000000004E80000-0x0000000004E81000-memory.dmp

                            Filesize

                            4KB

                          • memory/2548-440-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-436-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-432-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-403-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-32-0x0000000004E70000-0x0000000004E71000-memory.dmp

                            Filesize

                            4KB

                          • memory/2548-427-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-108-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-30-0x0000000004E10000-0x0000000004E11000-memory.dmp

                            Filesize

                            4KB

                          • memory/2548-412-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-27-0x0000000004E50000-0x0000000004E51000-memory.dmp

                            Filesize

                            4KB

                          • memory/2548-294-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-408-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-24-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2548-25-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/3012-397-0x0000000000400000-0x0000000000AF8000-memory.dmp

                            Filesize

                            7.0MB

                          • memory/3012-233-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                            Filesize

                            972KB

                          • memory/3012-207-0x0000000000400000-0x0000000000AF8000-memory.dmp

                            Filesize

                            7.0MB

                          • memory/3012-206-0x0000000000B80000-0x0000000000BA7000-memory.dmp

                            Filesize

                            156KB

                          • memory/3012-339-0x0000000000400000-0x0000000000AF8000-memory.dmp

                            Filesize

                            7.0MB

                          • memory/3012-205-0x0000000000C90000-0x0000000000D90000-memory.dmp

                            Filesize

                            1024KB

                          • memory/3644-191-0x00007FFAD8C60000-0x00007FFAD9721000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/3644-230-0x00007FFAD8C60000-0x00007FFAD9721000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/3644-222-0x000002A1A9400000-0x000002A1A940A000-memory.dmp

                            Filesize

                            40KB

                          • memory/3644-221-0x000002A1A9420000-0x000002A1A9432000-memory.dmp

                            Filesize

                            72KB

                          • memory/3644-190-0x000002A1A93D0000-0x000002A1A93F2000-memory.dmp

                            Filesize

                            136KB

                          • memory/3644-193-0x000002A1A8EC0000-0x000002A1A8ED0000-memory.dmp

                            Filesize

                            64KB

                          • memory/3644-192-0x000002A1A8EC0000-0x000002A1A8ED0000-memory.dmp

                            Filesize

                            64KB

                          • memory/3688-23-0x0000000000FF0000-0x00000000014BB000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/3688-4-0x00000000059D0000-0x00000000059D1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3688-0-0x0000000000FF0000-0x00000000014BB000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/3688-1-0x0000000076EF4000-0x0000000076EF6000-memory.dmp

                            Filesize

                            8KB

                          • memory/3688-2-0x0000000000FF0000-0x00000000014BB000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/3688-3-0x00000000059F0000-0x00000000059F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3688-5-0x0000000005A20000-0x0000000005A21000-memory.dmp

                            Filesize

                            4KB

                          • memory/3688-9-0x0000000005A10000-0x0000000005A11000-memory.dmp

                            Filesize

                            4KB

                          • memory/3688-8-0x00000000059E0000-0x00000000059E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3688-7-0x00000000059C0000-0x00000000059C1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3688-6-0x00000000059B0000-0x00000000059B1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3688-10-0x0000000005A40000-0x0000000005A41000-memory.dmp

                            Filesize

                            4KB

                          • memory/3688-11-0x0000000005A30000-0x0000000005A31000-memory.dmp

                            Filesize

                            4KB

                          • memory/3876-426-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/4216-139-0x0000000000400000-0x000000000044A000-memory.dmp

                            Filesize

                            296KB

                          • memory/4216-232-0x0000000000400000-0x000000000044A000-memory.dmp

                            Filesize

                            296KB

                          • memory/4216-175-0x0000000000400000-0x000000000044A000-memory.dmp

                            Filesize

                            296KB

                          • memory/4216-135-0x0000000000400000-0x000000000044A000-memory.dmp

                            Filesize

                            296KB

                          • memory/4216-171-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

                            Filesize

                            4KB

                          • memory/4296-86-0x00000000054E0000-0x00000000054E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/4296-83-0x0000000005500000-0x0000000005501000-memory.dmp

                            Filesize

                            4KB

                          • memory/4296-98-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/4296-79-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/4296-88-0x0000000005520000-0x0000000005521000-memory.dmp

                            Filesize

                            4KB

                          • memory/4296-85-0x00000000054C0000-0x00000000054C1000-memory.dmp

                            Filesize

                            4KB

                          • memory/4296-84-0x0000000005530000-0x0000000005531000-memory.dmp

                            Filesize

                            4KB

                          • memory/4296-87-0x00000000054D0000-0x00000000054D1000-memory.dmp

                            Filesize

                            4KB

                          • memory/4296-82-0x00000000054F0000-0x00000000054F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/4296-81-0x00000000004A0000-0x000000000096B000-memory.dmp

                            Filesize

                            4.8MB