lumma | 11202449315d0f2edb567c5f5e3e4bd403ae0985574344ea8ddf474c1b1fb440

Analysis

max time kernel
276s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Krnl.zip
Size 460KB
Sample240607-1jdl6seb55
SHA256 11202449315d0f2edb567c5f5e3e4bd403ae0985574344ea8ddf474c1b1fb440
MD5 0a6757a13623c4d9840b0aca6c243b52
SHA1 35804c36e9bccc5cac2d406d837fcc9e14060ac7
SHA512 0110dfb0886dcb22b0cc9243f36a1ce60929d00712e31e3eb0e268f9c89d42549ad974377fae8ca0c1919c8b33c1277bdbfe7fb34154f26a5ee0cb7dd9b21e3a
SSDEEP 12288:LANUGCFJT0fU0Yz3jBL75xwc4XscIFl4zA6fzvBLrkwRC:LAmFJcKjRdxwr81FlQxfDxrk7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Credentials

Protocol
ftp
Host
146.19.207.14
Port
21
Username
anonymous
Password
anonymous@

Extracted

Family

lumma

https://macabrecondfucews.shop/api
https://distincttangyflippan.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
5788	update.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5788 set thread context of 6104	5788	update.exe	123

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\7.5.2.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	208	firefox.exe
Token: SeDebugPrivilege	208	firefox.exe
Token: SeDebugPrivilege	208	firefox.exe
Token: SeDebugPrivilege	208	firefox.exe
Token: SeDebugPrivilege	208	firefox.exe
Token: SeDebugPrivilege	208	firefox.exe
Token: SeDebugPrivilege	208	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
208	firefox.exe
208	firefox.exe
208	firefox.exe
208	firefox.exe
5940	Run.exe
208	firefox.exe
208	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
208	firefox.exe
208	firefox.exe
208	firefox.exe
208	firefox.exe
208	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
208	firefox.exe
208	firefox.exe
208	firefox.exe
208	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 2348 wrote to memory of 208	2348	firefox.exe	93
PID 208 wrote to memory of 892	208	firefox.exe	94
PID 208 wrote to memory of 892	208	firefox.exe	94
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 2652	208	firefox.exe	95
PID 208 wrote to memory of 3416	208	firefox.exe	96
PID 208 wrote to memory of 3416	208	firefox.exe	96
PID 208 wrote to memory of 3416	208	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Krnl.zip
1⤵
PID:5036

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.0.1049701251\422724583" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1796 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1863332e-70a0-4892-8058-9c0bd63e5996} 208 "\\.\pipe\gecko-crash-server-pipe.208" 1964 1ee58cd9a58 gpu
    3⤵
    PID:892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.1.771552732\668664760" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2328 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00f538e7-15a6-4e78-914f-d603f0a0d7b4} 208 "\\.\pipe\gecko-crash-server-pipe.208" 2364 1ee58830b58 socket
    3⤵
    PID:2652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.2.1812366988\1477046540" -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 2968 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c0991ba-db82-4b62-9371-fa1396a69a06} 208 "\\.\pipe\gecko-crash-server-pipe.208" 3032 1ee58c5a358 tab
    3⤵
    PID:3416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.3.253976127\498308996" -childID 2 -isForBrowser -prefsHandle 3632 -prefMapHandle 3628 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbb0191f-444e-41b9-801e-1cabcdd93cdb} 208 "\\.\pipe\gecko-crash-server-pipe.208" 3608 1ee5d09d758 tab
    3⤵
    PID:1176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.4.688444328\1730577434" -childID 3 -isForBrowser -prefsHandle 4700 -prefMapHandle 4696 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b5e4a67-22ba-40d7-a59e-d02f7bf93ee9} 208 "\\.\pipe\gecko-crash-server-pipe.208" 1660 1ee5eed9f58 tab
    3⤵
    PID:2984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.5.1079327552\383431046" -childID 4 -isForBrowser -prefsHandle 4816 -prefMapHandle 5000 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffe233e4-3a98-4dee-94a7-079c6d2ee2b2} 208 "\\.\pipe\gecko-crash-server-pipe.208" 3740 1ee4512e758 tab
    3⤵
    PID:608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.6.2022230114\1967299466" -childID 5 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba56d5d7-140f-4f4c-8705-3bb69870cd83} 208 "\\.\pipe\gecko-crash-server-pipe.208" 5204 1ee5d09ec58 tab
    3⤵
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.7.63309837\1201668900" -childID 6 -isForBrowser -prefsHandle 5484 -prefMapHandle 5480 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe187eb8-8962-4b8a-b7bd-b2289ea7b963} 208 "\\.\pipe\gecko-crash-server-pipe.208" 5492 1ee5f87c858 tab
    3⤵
    PID:5108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.8.1527806874\330420193" -childID 7 -isForBrowser -prefsHandle 5276 -prefMapHandle 5940 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbae90d4-80a3-4abc-90fc-21c3054c70e8} 208 "\\.\pipe\gecko-crash-server-pipe.208" 5948 1ee61280258 tab
    3⤵
    PID:5164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.9.953934381\587868055" -childID 8 -isForBrowser -prefsHandle 4076 -prefMapHandle 3268 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c317114-1ff0-4bdf-9e40-582579b6a00e} 208 "\\.\pipe\gecko-crash-server-pipe.208" 2808 1ee614e1858 tab
    3⤵
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.10.680900374\217886822" -parentBuildID 20221007134813 -prefsHandle 4900 -prefMapHandle 4896 -prefsLen 26460 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9fab14f-4fcd-4dd0-9a39-f83729933c87} 208 "\\.\pipe\gecko-crash-server-pipe.208" 4908 1ee5f4a4058 rdd
    3⤵
    PID:6140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="208.11.2011526751\1161520679" -childID 9 -isForBrowser -prefsHandle 6268 -prefMapHandle 6304 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcfb7cc7-82b2-4230-9da1-f9ca27c9c1da} 208 "\\.\pipe\gecko-crash-server-pipe.208" 6308 1ee591e2858 tab
    3⤵
    PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:5264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5332

C:\Users\Admin\Downloads\7.5.2\7.5.2\Run.exe
"C:\Users\Admin\Downloads\7.5.2\7.5.2\Run.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmparq40i_k\update.exe
  2⤵
  PID:3332
- - C:\Users\Admin\AppData\Local\Temp\tmparq40i_k\update.exe
    C:\Users\Admin\AppData\Local\Temp\tmparq40i_k\update.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5788
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5988
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2264
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12266

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\12266
Size 16KB
SHA256 8660790b1edf0f789875d1723378d62a52efff2eb21975225e464da8bcb8c036
MD5 cdc7c496cd78732d50b7894493d8f2eb
SHA1 2f01af3ebaafa82bb3199c951fc3339f6edcac87
SHA512 32cb346773f590b75d5792ea3bdff7ae8b8b1a5ea6067b32721f86e489a7fa5fd3915a1a4aa0539bec71c7a61f60c08cdb315bbb11f2e73ab1a7e85399bde557
SSDEEP 384:vjZIRVhbkzudYKZHI7/cnkzudYKZHI7/28eehqrufWWCt2BVV1F:7ZIvhbkzudgknkzudgO8eehq4w2BVV1F
MD5 SHA1 SHA512 SSDEEP

Submit Download

21959

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\21959
Size 16KB
SHA256 d6dff095249d979de828eca761d3aec3e63b5b482b854f74032e2a6d3b1d1a0a
MD5 400c1f05c06e364b6dd2d27cf65d79e1
SHA1 467611ef9282a3ef8dbe954e3ca92d8a30d2895f
SHA512 04f73ffcd56fb346db017340b692c92c11e795c3c0f085424c7a721512858457c86d8dcca4810409c3ba024cfee249fcfaffaa9364cbce3e2d2dcc47285ea06f
SSDEEP 384:FZIRVhbkzudYKZHI7/cnkzudYKZHI7/28eehqrufWWCt2BVV11:FZIvhbkzudgknkzudgO8eehq4w2BVV11
MD5 SHA1 SHA512 SSDEEP

Submit Download

0DE2403E40606B9197622D9499699DCABEF1EE41

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\0DE2403E40606B9197622D9499699DCABEF1EE41
Size 14KB
SHA256 d1ad0b083a7fcb49ec3323d5bcf479bd89b75488cc7e8a1e6ca47a9ea877dbb7
MD5 69a86154a5033a21e89ebae87418a049
SHA1 d2f57e3006cc1e742797e560129600705ac5b79a
SHA512 72e708a870b8aabb7b6244028fb2dff0e49666facf0c9bec0211a8f3ef45da23ed297ee99362eeb74d2e20be198aa9c5aeb9b9d45040d002f620fb412acb01dc
SSDEEP 384:jjNmqxrZMG+CQKwSc9Pr7Fc9Pr1y8D9Gpo/VMAkxkU:PEqTM/pSc9Pr7Fc9Pr1y8R8o/VM1
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\tmparq40i_k\update.exe
Size 540KB
SHA256 a81808810057944530b126dfb6558b362d7c0bd3ad3e2d80ecbcd4720f6fed35
MD5 188766d3c11541238c2f3b363b742154
SHA1 c12faa9f844e633e9e4c28d331b291e35c11946a
SHA512 2bda65ed4d65d38c0a2469f8977491c6400d36a3db462e1b3dbf973a9f5f7ba8ef6f949fa0f32b49be5795a2c323f42e8dd2cc4b2aefb9bc12b89faae95bf245
SSDEEP 12288:RiQ6aJMg2igCzHupaOfB7eV2BSdS9+pwyqoH1JD4oEO:RqaRbzHuppJ7eVE9+p/HT4ot
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 20KB
SHA256 9889b958676923fd76a6d28fe41ed22cb7547e4c86ee0afc325a76e3bac382cc
MD5 2c3ddd5d68ad5c1012a4165e9bd55c79
SHA1 0c56c50c7f5bc071f36535bf4684db509ac05de4
SHA512 57acbd7064e5ec9d36fb30ddab27468edf6330c779fe987fa6aa744d10088c28aabfb5e9d8d2a75bc5290b426768e727c47ac75ad4d93b9487c4774825a79e38
SSDEEP 96:vy07/BNB/MmcllM5RcllYMnrJ7MnrJncllYMnrJsMnrJnclloocllh2OCcllDOos:Ks5v/MFzpz9m2z9j2zoDzc4zDKzciDj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 ce3936db499cb373efccfdc9c81b0f9ae64be844a51cfb061b8c1dcd969bd73f
MD5 dff7af0c696fec31862c1c7e7168c8f1
SHA1 33f130fdfa30a9fdba66c2ae1a060d5cdce507b5
SHA512 29349d9470551f671b550d657494b1739d99cf5800a8936ea721531f1f04bffa1064427dd806a8d11ed516cd569f73720fd9c7e8b3fcd6c8510fa3b136591f84
MD5 SHA1 SHA512

Submit Download

6fba4957-690d-42c5-aebb-636f511fe3f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\6fba4957-690d-42c5-aebb-636f511fe3f0
Size 11KB
SHA256 e0ff9fc5d084a4d3546e0dd45c085f679ffef36b1563e74e8ebce3fce5c6ff87
MD5 5047254e301d1d3f934d6468962d6c84
SHA1 01fa386388e0637ae0fc95adb4fb833e25f8e642
SHA512 420f50fceb3a08e405ff2d8d171af2f22607c3117f1a2ec68dd1e6189eab16589a71bf39d89cad55b7f2b92c9ec44fa0b3b1c9a87efadf607752490d79bac363
SSDEEP 192:JvTeXFx8GR1LI4TRJx9qfACKT7hrUiMVDDwSbqqOpwtSsn5hbCRjlwxC6nZJWQLX:JbaHWqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

bc242aa2-c2b0-4167-9e6c-f5a76aaf92de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\bc242aa2-c2b0-4167-9e6c-f5a76aaf92de
Size 746B
SHA256 b9de510100ace19bf1ec72ea01ab9869a0304ddae1fca234c1e84e64974fb0cd
MD5 3beeef6c57ed72e1b5a4e0ae3d6d1dc0
SHA1 01f104d209065ecd1fc1b67c931fe1f6ea394aa6
SHA512 7ad2ca85daf562a9714068e29b93dcc50a1f93beaa81c68e89e07f0a683c607fc94066395a94bc5a46bef1c9697eed6e58cab04d101276a66a2afc59efa63ee8
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 7KB
SHA256 6a11469f179343108f85dc9217b6f4d838c1db9b55d3254f4f581bd5a490ddc7
MD5 a1989c46b9401d6e77c010d2783d69f0
SHA1 8b7590a8968e05546f695a61ef06abfa25052906
SHA512 5e9c833d43371e1896581dcc2fd159fff98dfe288d1bb64deedfa6d08e5c7e67b50d8df90328feb7e75952154ea1f07d699107926554a98c5f58cfb3d0b1a185
SSDEEP 96:xH5g8nUTBPqGqpdIdSeOTzSMPXAnpj3HhE2u5DtwBw8H7kLGS:88nQCRpdIdSeaPXYhExXwBw8H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 6KB
SHA256 79de13404ef7c77233f3727fd82e4c481c10e97966cea207dde3ccf339ca1c42
MD5 cf403e81c3ba5ab9ada59688ee1ad790
SHA1 5608f6ea22eb29078e765733493574bff70c6a10
SHA512 f0f58d0e94f1b2415e57585969e55237b5c91f7ea21955a227bd83b3f5dd59e4587a0d6880e53aac46d242634dc0dd1f9cb8f529151437db4fc39f95bc53efa8
SSDEEP 96:xHGgnnUTeqGqpdIdSeOTzSMPXAnpj3HhE2u5DttBw8H7kLGS:3nnIRpdIdSeaPXYhExXtBw8H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 6KB
SHA256 1134a2279ad002d83d25835938f04355215067501391f9cad36b80fb00ceb479
MD5 953b1b956479484c1d573579e7dc087c
SHA1 d6e96595ebdda3a9af2bf38e0b5ff871aed45f2a
SHA512 c4997351db948240ed50df392785bf5df045fe2e31c429a08e8a3917bc05a61e1cc6d4de32677d77428511d35e5f7edf8805b245b4022051e245eed07277d5ca
SSDEEP 96:xHGg5nUTeqGqpdIdSeOTzSMPXAnpj3HhE2u5DtABw8H7kOGS:35nIRpdIdSeaPXYhExXABw8HB
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Size 6KB
SHA256 6601df14391bd4025bcee16f46d8f5273c16be86b31d471b92837776581121b5
MD5 78a1535d92a1e831d6d323d36935df7a
SHA1 25b48f3e0b5783f888bac0b7abe2a1eb83fbddee
SHA512 057228e572efdb5cc99b6a7acc183b37ea17ff7a4fe2ee518f3f71eaafc34a77d4a752d269c996ffaaa207c0d3b3dc1641791d57658f1da59b0a7fe5e1e90a2b
SSDEEP 96:xHGg5nUTeqGqpdIUYeOTzSjPXAnpjvHhE2u5DtABw8V7kH:35nIRpdIUYeNPXAhExXABw8VC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Size 6KB
SHA256 1631bd7992a0e6a0d49a731baff72fb47b82e195ba27c775376c93801ddb6390
MD5 bd26792e0ba9fc3b6dc7dcbde45960a8
SHA1 af4cf6d1c28ae054d5f05f33b343876c5ffadd67
SHA512 f9dc4539fb59c5437395426061f65fcc8355fae287b46136d4588adf54c66eb2e33e446f84c22fe89410560bd30dff18ace4455892bdb7a8181902ed8f5cc6a7
SSDEEP 96:xHGgnnUTBPqGqpdIdSeOTzSMPXAnpj3HhE2u5DttBw8H7kLGS:3nnQCRpdIdSeaPXYhExXtBw8H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 4b006214a970d119a606b906b8164d99d18dc6250cf3577d42dc86af8904b0f3
MD5 58f4ef84bab8fb2d28d1cd5d00c661bf
SHA1 24f2268c83aa2e618608d080dba2d5411d6e2c9d
SHA512 8c7f0444a18a2afe9a321d346361565e6f0fae4280a2abe4ca42199ebd1003079942182639783f337bd9172d63fd56a2883f84767621823ef1ef1dc94b456269
SSDEEP 192:CqM4XEuHyX9G9MCdJT1jk0IxliTCfC7yqDsVcSYfrfWchYKHFFSIX4aRQZ:C1GrHyXE9Rdd1jkTiefCGxgzl9hXt8
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 005461a8da8711276d4a2105b385f4c7636d817bedde854dc1730cad71cc9e6f
MD5 4aad97000a03c38fa60c0a6cee50399f
SHA1 90e090f4a9c2dad78c0335d2c9ec4f5d2ebe9643
SHA512 866b18b1530c7f6e853a1a6fa6a78f9d0ef9ed296ae2aebf4247941c5be78c3856ff571508d865994f7ec46d448892b0357de22a791ed539fd0ac4d47f76ea4f
SSDEEP 192:pqM4XEuHyX9G9MCdJ2R+4vYP9HoC16kyGvdVXAGn30lr0JxZcQKGYKFJz8DgIzaV:p1GrHyXE9RdsR+V9HT167YXT32gnFxN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 1a6018020701df39b992e89a55c68e1d5c7d51ce3fb0b8db94fc61f82a2b83e5
MD5 3695d8c3672f918ec1cb167309438529
SHA1 f0a8ee7998dd7e3ab16e0ea8816539c5840afe03
SHA512 dbf8abb032d7dd25c3950dc6d34d12c0e0c5414ac73c4f48a3bdceed093cb93aeef53f3df0f8a9f79b52a0f5096230b6f5b8e00cba9869186aa2f65d67680d1f
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 1964f5abbd311cb7809acd7d5f0f2164551f4a159ec6977b2a48b8912061d8bf
MD5 bd056e649a460c9dad0d488bae81143a
SHA1 9379094e88f4ec80145d640f9325f906ac5b1c0f
SHA512 86ffc886a8ab81afe3a08186f1bc524b0031bf82906a731b8e477c02f6fcba2335382964f6c773c29d6a87c460502d9fa8aa1134ec448315883d5e7dbd11c7d7
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 4b860912b1873c0541d4b7b4607e33b224728f3834698454bae14041d05e10cb
MD5 fd1e03a713f5bb72e4a5dc5d48a31105
SHA1 f6519afdf32673d4533f686b414183a5fcf39d4b
SHA512 0b3c5afe3b665d030cb9dfe1c21124edfa26090f189f20236df715433796af5e70f3900e9d9490f3de809f403a21d61bdfd28c8aa74c0aa2db424b65ac082e36
SSDEEP 96:MbzqM4XO1uHyX9GowMmjs/Sx2OiIbB47IBKiZaPEirRj/i3:aqM4XEuHyX9G9MQyX6bOIBVaRI
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 804f530c8faf0bd9a02b58376e9da37ffcf3d81a568669460585539c947d0418
MD5 fbb27f949cbd292fe14cad75a71f595e
SHA1 3b0c28412629c451a997ac5d468a989600553934
SHA512 2730cbbb4fd4bf7b0006d3a33f0f2705eedb02548d77b6fb92f8c4537c020ffcc76c60e7dc65d8d05595d408e8ccd8e8b7f3e7f3d62468be4716620c65f92646
SSDEEP 192:KqM4XEuHyX9G9MCdJT1jk0IxliTCfC7yqDsVWjX61gpEaR+1:K1GrHyXE9Rdd1jkTiefCGxWjOgpZk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

7.fYFciCsK.5.2.zip.part

Path C:\Users\Admin\Downloads\7.fYFciCsK.5.2.zip.part
Size 4.8MB
SHA256 13a1ab0f8fc7c3c5199be698fe8ea21c969b1e1900c85a219bfc21564012bbe1
MD5 2e183eb8c1677b5bca4b6c0956dddeed
SHA1 215f0eb182c4b0f5576d091d77a1f6ea5f92b590
SHA512 c0e9b018636b9b158dbf328c13a174a6c8c7ed2b8e207fe291ffd6a84ee8aaabec37e46861ce648d56bdc78e83b9ac3129c50501c09e97b01db390dffb4712ee
SSDEEP 98304:OP1ai2sn2RV/LBlkMtiDyKWSu3E/zChAK:OP1t+RVrRoDF3u34ChAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5788-756-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/5788-754-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/5940-798-0x00007FFFE0840000-0x00007FFFE086A000-memory.dmp

Download

memory/5940-747-0x00007FFFE0840000-0x00007FFFE086A000-memory.dmp

Download

memory/6104-757-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/6104-755-0x0000000000400000-0x000000000045B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads