luminosity | 38f65385a0767c22fb3fb3c181ad1dcd576dd9f623ef6aa3df6c01e2b50d5c61

General

Target

e-cataloge.pdf.exe
Size

1.2MB
MD5

3f379c45cf293566709f473ea1f38125
SHA1

825af50daf0146a5f16aa6e3f59fa5320def4735
SHA256

94b795d57617222666cc16d4c9928841d781ba8d2406a188314e51a48f5d10da
SHA512

7a124fe558e4d8d1aed01be8d5d9720e7fc07d2f4a7215392eb4e4883e2191820a2e45f36c922e49aa2989301f379f43361d11558b43f4b6d814140eb6e90add
SSDEEP

24576:s+o/NuOhnPXVW9+E7a64d968HFghHqnqXg6cU9KXLNJCR+0MNDjCO4pF:IlvnPlW9+En4d08lghHqqQqoGsDjCNF

Score

10^/10

luminosity persistence rat

Malware Config

Signatures

Luminosity 3 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

Processes:

e-cataloge.pdf.exeschtasks.exeschtasks.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	e-cataloge.pdf.exe
2632	schtasks.exe
1536	schtasks.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

REG.exeREG.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1536 schtasks.exe

pid	process
1536	schtasks.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

e-cataloge.pdf.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	e-cataloge.pdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	e-cataloge.pdf.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	e-cataloge.pdf.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	e-cataloge.pdf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e-cataloge.pdf.exe

pid	process
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe
2020	e-cataloge.pdf.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

e-cataloge.pdf.exe

pid process

2020 e-cataloge.pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e-cataloge.pdf.execlient.exe

description pid process

Token: SeDebugPrivilege 2020 e-cataloge.pdf.exe
Token: SeDebugPrivilege 1712 client.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e-cataloge.pdf.execlient.exe

pid process

2020 e-cataloge.pdf.exe
1712 client.exe

description	pid	process
Token: SeDebugPrivilege	2020	e-cataloge.pdf.exe
Token: SeDebugPrivilege	1712	client.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

e-cataloge.pdf.exetaskeng.execlient.exe

description	pid	process	target process
PID 2020 wrote to memory of 2632	2020	e-cataloge.pdf.exe	schtasks.exe
PID 2020 wrote to memory of 2632	2020	e-cataloge.pdf.exe	schtasks.exe
PID 2020 wrote to memory of 2632	2020	e-cataloge.pdf.exe	schtasks.exe
PID 2020 wrote to memory of 2632	2020	e-cataloge.pdf.exe	schtasks.exe
PID 2020 wrote to memory of 1220	2020	e-cataloge.pdf.exe	REG.exe
PID 2020 wrote to memory of 1220	2020	e-cataloge.pdf.exe	REG.exe
PID 2020 wrote to memory of 1220	2020	e-cataloge.pdf.exe	REG.exe
PID 2020 wrote to memory of 1220	2020	e-cataloge.pdf.exe	REG.exe
PID 1372 wrote to memory of 1712	1372	taskeng.exe	client.exe
PID 1372 wrote to memory of 1712	1372	taskeng.exe	client.exe
PID 1372 wrote to memory of 1712	1372	taskeng.exe	client.exe
PID 1372 wrote to memory of 1712	1372	taskeng.exe	client.exe
PID 2020 wrote to memory of 1712	2020	e-cataloge.pdf.exe	client.exe
PID 2020 wrote to memory of 1712	2020	e-cataloge.pdf.exe	client.exe
PID 2020 wrote to memory of 1712	2020	e-cataloge.pdf.exe	client.exe
PID 2020 wrote to memory of 1712	2020	e-cataloge.pdf.exe	client.exe
PID 2020 wrote to memory of 1712	2020	e-cataloge.pdf.exe	client.exe
PID 1712 wrote to memory of 1536	1712	client.exe	schtasks.exe
PID 1712 wrote to memory of 1536	1712	client.exe	schtasks.exe
PID 1712 wrote to memory of 1536	1712	client.exe	schtasks.exe
PID 1712 wrote to memory of 1536	1712	client.exe	schtasks.exe
PID 1712 wrote to memory of 1880	1712	client.exe	REG.exe
PID 1712 wrote to memory of 1880	1712	client.exe	REG.exe
PID 1712 wrote to memory of 1880	1712	client.exe	REG.exe
PID 1712 wrote to memory of 1880	1712	client.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\e-cataloge.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\e-cataloge.pdf.exe"
1⤵
- Luminosity
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
  2⤵
  - Luminosity
  PID:2632
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
  2⤵
  - Adds Run key to start application
  PID:1220

C:\Windows\system32\taskeng.exe
taskeng.exe {C42BD75F-720A-40B3-8433-CA7AB19C895B} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Client\client.exe
  "C:\Program Files (x86)\Client\client.exe" /startup
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
    3⤵
    - Luminosity
    - Creates scheduled task(s)
    PID:1536
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
b8580ddaa0a4baef024bf6dc0235a5fd

SHA1
2b70d795ff52433de6b45fbc180d34f05ac11f34

SHA256
0cac8b67ae22816af07ff37e607ec304b1c670ac792f45f34672dc6d613c4d61

SHA512
cb77d6b3b3cb20ff7bb84ec0c83e8ff3d0f1c916cdd1b76bf8ad9b4019afdcbde7043603177e19319867e653b386b0396680fafd26b06764df53a8372a1ecd80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162

Filesize
471B

MD5
5fc585ad8ccb121d30a05982c2d33bb1

SHA1
a2cb274463a1945a875c80731afd01855abb32e3

SHA256
54a4e08a1d51525e6721b5cf219edb9649195c623a57667ea9e53a50c479b01d

SHA512
0ecc3f89130f802b38c8ff9a6fab3be68f12b09943529ab877cd8207f3100969e06df2b9bd0d5e61eec1dd9cbc3a34ab99e85fe6bd5dd71afda9736993caa9d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
404B

MD5
0c491154000c07fdf6dfbd9319c5895c

SHA1
eca18dfa388472a87c8ddaac299f79e467ebcd3b

SHA256
ae6ba6da5159cb80a347162eac82110c1c96a02e1db36332a1476e82939876e3

SHA512
28b397557ae0918b1d5dec3072c4059cbe5dd2f6dabfaf5053e9cebac774bb98cb638025c437afed82069663240de21003b144a9335ecda40cb69f8fc12d5d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162

Filesize
400B

MD5
bfa9d4c87ade459a91d14722e420cc09

SHA1
3f06e0b9abe1fb39d57ebbf2937237bd5fb75e1a

SHA256
a8f61000e4f1a68745481c1455ed042b5cd670269271a4c8b40985fc9c174abe

SHA512
256ad37a1a875ee95056b8cf081ede705b60cabf7c0ba2a18d7f3f698d77aa4f6dbc9425e762a22c5832037fb6d8da89c0d4fd6e60eb1bff33cf960dafab7826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e7d121c5e96163020d571eda8ec7b64

SHA1
33421f4ef31b8b7004a71eaf0ba3cef391bd3145

SHA256
0fd29a8311cb594ffdc37a391ad9000b3413c36256a8f76938da98b066e4c5ef

SHA512
4eb3e9ed0ea0b019a9772d5fe6829eb186034dae78dfcfbbfba898f0395bf0fc3da564b52403a3cb68aa7b17b5efaa7b2bc97fcea0395c3982fbf624c97b4a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EC8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/1712-39-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1712-58-0x00000000004C0000-0x00000000004D7000-memory.dmp

Filesize
92KB

Download
memory/1712-69-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1712-68-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1712-57-0x00000000004C0000-0x00000000004D7000-memory.dmp

Filesize
92KB

Download
memory/1712-40-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1712-60-0x00000000004C0000-0x00000000004D7000-memory.dmp

Filesize
92KB

Download
memory/1712-56-0x00000000004C0000-0x00000000004D7000-memory.dmp

Filesize
92KB

Download
memory/1712-66-0x00000000004C0000-0x00000000004D7000-memory.dmp

Filesize
92KB

Download
memory/1712-63-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1712-65-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1712-62-0x00000000004C0000-0x00000000004D7000-memory.dmp

Filesize
92KB

Download
memory/2020-1-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/2020-2-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/2020-37-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/2020-38-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/2020-0-0x0000000074701000-0x0000000074702000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads