lumma | c799e5e10709df5ac5a1f7fa57757d819169eb989da0a17837852826366f0618

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
[email protected]
Size 14.2MB
Sample240709-df6gfssgpm
SHA256 c799e5e10709df5ac5a1f7fa57757d819169eb989da0a17837852826366f0618
MD5 c02acc9d1f6b722db01cdebda7261f3a
SHA1 9dfc99b14991c753ed46daa47ebb8ab6a72b41c3
SHA512 b35d7d692cdb46cc11a95479aafce9986647f0c252a3c203b93dba9d095f18844f2c0803cd965082397453d22ef9c4671755182d5a7ddc31a3b6d928b88b888b
SSDEEP 98304:MvJ6ElnqpxqUpOCLuMl9JrI6VKn+cIzNzCuCEAdLN3qgo:UkDFCMl9qQzZCAA+5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma execution persistence spyware stealer

Malware Config

Extracted

Family

lumma

https://bargainnykwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation	Z5D2PNX7CIYJTPCXXYD.exe

Executes dropped EXE 9 IoCs

pid	Process
3196	Z5D2PNX7CIYJTPCXXYD.exe
3544	7z.exe
2208	7z.exe
404	7z.exe
1220	7z.exe
3308	7z.exe
3896	7z.exe
2064	7z.exe
2332	Installer.exe

Loads dropped DLL 7 IoCs

pid	Process
3544	7z.exe
2208	7z.exe
404	7z.exe
1220	7z.exe
3308	7z.exe
3896	7z.exe
2064	7z.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	pastebin.com
24	pastebin.com

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1324	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 512 set thread context of 4360	512	[email protected]	86

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
852	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3284	schtasks.exe
4540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4360	BitLockerToGo.exe
4360	BitLockerToGo.exe
4360	BitLockerToGo.exe
4360	BitLockerToGo.exe
2332	Installer.exe
852	powershell.exe
852	powershell.exe
2332	Installer.exe
2332	Installer.exe
2332	Installer.exe
2332	Installer.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeRestorePrivilege	3544	7z.exe
Token: 35	3544	7z.exe
Token: SeSecurityPrivilege	3544	7z.exe
Token: SeSecurityPrivilege	3544	7z.exe
Token: SeRestorePrivilege	2208	7z.exe
Token: 35	2208	7z.exe
Token: SeSecurityPrivilege	2208	7z.exe
Token: SeSecurityPrivilege	2208	7z.exe
Token: SeRestorePrivilege	404	7z.exe
Token: 35	404	7z.exe
Token: SeSecurityPrivilege	404	7z.exe
Token: SeSecurityPrivilege	404	7z.exe
Token: SeRestorePrivilege	1220	7z.exe
Token: 35	1220	7z.exe
Token: SeSecurityPrivilege	1220	7z.exe
Token: SeSecurityPrivilege	1220	7z.exe
Token: SeRestorePrivilege	3308	7z.exe
Token: 35	3308	7z.exe
Token: SeSecurityPrivilege	3308	7z.exe
Token: SeSecurityPrivilege	3308	7z.exe
Token: SeRestorePrivilege	3896	7z.exe
Token: 35	3896	7z.exe
Token: SeSecurityPrivilege	3896	7z.exe
Token: SeSecurityPrivilege	3896	7z.exe
Token: SeRestorePrivilege	2064	7z.exe
Token: 35	2064	7z.exe
Token: SeSecurityPrivilege	2064	7z.exe
Token: SeSecurityPrivilege	2064	7z.exe
Token: SeDebugPrivilege	2332	Installer.exe
Token: SeDebugPrivilege	852	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 4360	512	[email protected]	86
PID 512 wrote to memory of 4360	512	[email protected]	86
PID 512 wrote to memory of 4360	512	[email protected]	86
PID 512 wrote to memory of 4360	512	[email protected]	86
PID 512 wrote to memory of 4360	512	[email protected]	86
PID 4360 wrote to memory of 3196	4360	BitLockerToGo.exe	88
PID 4360 wrote to memory of 3196	4360	BitLockerToGo.exe	88
PID 4360 wrote to memory of 3196	4360	BitLockerToGo.exe	88
PID 3196 wrote to memory of 1476	3196	Z5D2PNX7CIYJTPCXXYD.exe	89
PID 3196 wrote to memory of 1476	3196	Z5D2PNX7CIYJTPCXXYD.exe	89
PID 1476 wrote to memory of 3720	1476	cmd.exe	91
PID 1476 wrote to memory of 3720	1476	cmd.exe	91
PID 1476 wrote to memory of 3544	1476	cmd.exe	92
PID 1476 wrote to memory of 3544	1476	cmd.exe	92
PID 1476 wrote to memory of 2208	1476	cmd.exe	93
PID 1476 wrote to memory of 2208	1476	cmd.exe	93
PID 1476 wrote to memory of 404	1476	cmd.exe	94
PID 1476 wrote to memory of 404	1476	cmd.exe	94
PID 1476 wrote to memory of 1220	1476	cmd.exe	95
PID 1476 wrote to memory of 1220	1476	cmd.exe	95
PID 1476 wrote to memory of 3308	1476	cmd.exe	96
PID 1476 wrote to memory of 3308	1476	cmd.exe	96
PID 1476 wrote to memory of 3896	1476	cmd.exe	97
PID 1476 wrote to memory of 3896	1476	cmd.exe	97
PID 1476 wrote to memory of 2064	1476	cmd.exe	98
PID 1476 wrote to memory of 2064	1476	cmd.exe	98
PID 1476 wrote to memory of 4892	1476	cmd.exe	99
PID 1476 wrote to memory of 4892	1476	cmd.exe	99
PID 1476 wrote to memory of 2332	1476	cmd.exe	100
PID 1476 wrote to memory of 2332	1476	cmd.exe	100
PID 1476 wrote to memory of 2332	1476	cmd.exe	100
PID 2332 wrote to memory of 1324	2332	Installer.exe	101
PID 2332 wrote to memory of 1324	2332	Installer.exe	101
PID 2332 wrote to memory of 1324	2332	Installer.exe	101
PID 1324 wrote to memory of 852	1324	cmd.exe	103
PID 1324 wrote to memory of 852	1324	cmd.exe	103
PID 1324 wrote to memory of 852	1324	cmd.exe	103
PID 2332 wrote to memory of 1544	2332	Installer.exe	104
PID 2332 wrote to memory of 1544	2332	Installer.exe	104
PID 2332 wrote to memory of 1544	2332	Installer.exe	104
PID 2332 wrote to memory of 2564	2332	Installer.exe	105
PID 2332 wrote to memory of 2564	2332	Installer.exe	105
PID 2332 wrote to memory of 2564	2332	Installer.exe	105
PID 2564 wrote to memory of 3284	2564	cmd.exe	108
PID 2564 wrote to memory of 3284	2564	cmd.exe	108
PID 2564 wrote to memory of 3284	2564	cmd.exe	108
PID 1544 wrote to memory of 4540	1544	cmd.exe	109
PID 1544 wrote to memory of 4540	1544	cmd.exe	109
PID 1544 wrote to memory of 4540	1544	cmd.exe	109

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4892	attrib.exe

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Users\Admin\AppData\Local\Temp\Z5D2PNX7CIYJTPCXXYD.exe
    "C:\Users\Admin\AppData\Local\Temp\Z5D2PNX7CIYJTPCXXYD.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p1404753551733818025492326517 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "Installer.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
        
        "Installer.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2332
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C powershell -EncodedCommand "PAAjAEQAYgBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaAAxAFQAagBxAGMAUgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBWADUAeABBAEQAUgAxAHUAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQAxAFQARQBvAHgAVQBZACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
        6⤵
        Power Settings
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -EncodedCommand "PAAjAEQAYgBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaAAxAFQAagBxAGMAUgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBWADUAeABBAEQAUgAxAHUAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQAxAFQARQBvAHgAVQBZACMAPgA="
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:852
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4540
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk1300" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk1300" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Z5D2PNX7CIYJTPCXXYD.exe

Path C:\Users\Admin\AppData\Local\Temp\Z5D2PNX7CIYJTPCXXYD.exe
Size 2.5MB
SHA256 771b76ba28496c56d1d9c0fe67fdf7688a2f1b12a9eb428050551338945337a3
MD5 b2e6a3d0bf3320b759c464ae6fa5b735
SHA1 cc9f5de7742b9c11f7c0c0e3f9d39b0c16b38cc1
SHA512 bf2f09aebf6d4b07ec06ce37617361e149b26d7fc2f5c0715a5e479747eb5b1f8fc615c90d1e4d8d751e05dd566819facfef8a00cfb7acb61ec588b0c23b022a
SSDEEP 49152:+j5X4U+fS0UNmqbH5IBSxtbHtflIDW1D5ETdUIsVXnQgq+OBelZXH:+j5X4UCUNnbW6fquUwVXn0fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_24kkm4ev.iqj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_24kkm4ev.iqj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
Size 21KB
SHA256 c07698b4c960b60d8a3c661887d6cc1f7fe74e31a24d4c2ae95d52d1c92ce403
MD5 4265bf9f9535ebb4e1830e2a50589285
SHA1 ddc45fe277a3b39179dd9e39e17d71b50a184607
SHA512 3a7a0a8a6b82d5e1b6c06c12250eb9b347ed024811467d6da5123f6d07a79836a4e414758cb5c708d0c96cc4a020f8743b2c1e4fa5f5ed448fc087772ab592be
SSDEEP 384:WbjjHZQ3NMofJHFrybCN906pXtM5PFNwN9zmm115/uf8WrynX:WbjjHe39BgbGqBFNwvfNj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ANTIAV~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
Size 2.2MB
SHA256 e92508881b6d69c45897a58b4c7dc58ee68e438979604d7f7b6f6ff71f15444d
MD5 6dd7f70cddc4310e047032d70550f72c
SHA1 e93c0d3a03dbe51eba117ea8e10bd0e8b6b27562
SHA512 1e6398a9739f57a3cf754a6e73f92cf67fe117440a6afe698767c578f396a4b8dab93b5568d02fa23fbcd3565b9017254625d58b1ea7a375c8537f2bab90f42c
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xZ:R9kqGu7okoZscCnf0/Zs9G
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
Size 9KB
SHA256 06d1004f28a87b42b1d7ac23ff2e4b43d736295abc2e84740504386f40a041f4
MD5 18f4fe969c4ba0517b403e28f7ad2b72
SHA1 9df09751ee1246db2ed6b6ed6fec87fb0891e077
SHA512 9847b8e2b849b09a76e22ab0d76a1a7d29079676dbdf4277b712709af0ac6a6f0e3a473f144f0a8e247861111357027a758b95e4d096d24cec160192c5da32a4
SSDEEP 192:VM1hnl/CQxAqZOqVUhb1UXZ5a1rMqr1+OW9RGnGxKIC3SdgXp8TmmAb:gHCMPZvUhKp5T6oOMNJCi6XpuE
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
Size 9KB
SHA256 5e2e339dbee22d6c05d652646071bc81ad96a6422eb311453ca3905e7dfea285
MD5 a915fd2a4e2750ee9003e628294bf284
SHA1 f9adc1e65fc3d2cf39b2c5a89030f3225e21616d
SHA512 044d5370ec915fb488cf77c1b181f5a4f89833028266f922766b782ff445f61ab85b92980d6939d0e252a368eb846def27bcdea7f029999d6854a90c793b3a5f
SSDEEP 192:KHrQAk4+JgGTO0SXMxudCGu9fPiHVWHktdmoFc+eFwdeKzb6tAhUs/:crQA9mO0S/gPi1X7pc/F4vPEAv
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
Size 9KB
SHA256 88b2d9a82c911ad61f3570aa31b360ae1649b117f6495459698d724f0c9638dc
MD5 4a5f569872c858ede1c0c67500cfdd6d
SHA1 cdcac69d89b45a7903198467c2d2d32126c31661
SHA512 d9c6776829def517a253e9c60d0316dbc03092f850383305089dc1110b1abd19668ae47dca8188e96c6f12b66a8e5b5a783901f2115cadd5c1accf019c3bdb40
SSDEEP 192:I2rAE/JVUlmamg39JBboi8ohZX8VDJS00r/Jz7ibLVwkUDWHinZ:I28EDUl5mEXBNXGz0r/J/ibLYf
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
Size 9KB
SHA256 b61a321a8a1f4ca1d8c52a1ad0464ac5882073ac8da7c5585f04ce2330b78acc
MD5 6f7f4f7ed739e3ac5eee8d0876ff76d4
SHA1 9a65d52885624dc47f342b5a9875d7720540c755
SHA512 35cad901c3f77c58803372a2f230701469d99fb9d8b16d82b59416a62d215614ab044dcae123473cc5d9a4a09e23f2edaac53ef82bbd5b3556b9b187cff50021
SSDEEP 192:PF2O5lLEgZVGoqMpVkMDg52dLX+5Q/a4ArVLGvSN47zZoMYIG/lsJdCcvz:sO5lL3ZVGoqkY4N0QCvVaY47zyplsTCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_5.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
Size 9KB
SHA256 814a92267e0d8867932afd625f2f8e55b04b88b2cfc31e91b6e45e473f1b057d
MD5 870a5535c79edcf782551514f48d89ab
SHA1 333d814d65753cdc4c4e8fb587c09af6960110d1
SHA512 f8743ca2f1ef2433b41adc41adf6a5836c1901bda70d5d76301cb06b471796b360544efa591c49b3a7d09eee12cef7ba20e79571f50d891d4729598210772b06
SSDEEP 192:QJL7m5uXQ05bVwcrGe/pE01aPhaHYZ3BB+qDFSl9aIh3V0FzRs0qpN:ivX5VhiAK0L6DF+YIh6fsbpN
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_6.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
Size 1.6MB
SHA256 0bb07f0caab7e5539e7efeca5bee359d9f6b49237e0c908981d9168680fe2b3e
MD5 a62944686498212b290eae637729a151
SHA1 2053660850d3f578f7b31e5ced16069d6f9c4ee0
SHA512 ae6abd482552445cbf8c308948519227b0d1a82c1b3adb4800f8c9ac32c519c8d0aee8f3b4caada26d1976b63b032aad72d95e574adf205b947dada23a5b8ad3
SSDEEP 24576:sbI/7AAb+JQl3Vd02kOC/l5X4/KiROMdWbBkDC6SX39qbwK1ZNKdvLIJvQ27kjo/:sujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.bin

Path C:\Users\Admin\AppData\Local\Temp\main\file.bin
Size 1.6MB
SHA256 ba5270891d3eef832fe34f9d67fbbb30ceb3873552ea859139914a6a783b0aa1
MD5 716459a6ceac7d310d4227ea3e9ddb59
SHA1 fa27addf18c197bf5fc054bfb5ae57de1caf3382
SHA512 3857cc099edd99f1c20d4c4456ec4577478afcbdb6073852c6df10775a4e6de0316ab68c6dacb7212d27f49057312ba1aeb0c35e695d84832f3e9f8d61f7d8c1
SSDEEP 49152:uF+Ae5RGlU1D67KN2nn4vQh3Bz+uvFd7v:uFlTepDGn4vOFF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.bat

Path C:\Users\Admin\AppData\Local\Temp\main\main.bat
Size 474B
SHA256 e0855b82ec99b14bdfa38dacf90dadb2071e0d413c6559c752e0b2c6e8cd08c0
MD5 893874465a8d9f68f0684fd61e9f1d3c
SHA1 866a58255ebab05d4ee2f2ed8383a6555ac1df03
SHA512 1cc878a3236a5ce4f3a89fae580b4d16a7842fd03dfe0a2c7d1d5da5be822528ea3826f659a70de727c9307fb15997f56b7204582043dc7efcc6c818f7aa2bd7
MD5 SHA1 SHA512

Submit Download

memory/512-5-0x00007FF7D9870000-0x00007FF7DA70E000-memory.dmp

Download

memory/852-107-0x0000000006500000-0x000000000651E000-memory.dmp

Download

memory/852-95-0x0000000005F70000-0x0000000005FBC000-memory.dmp

Download

memory/852-123-0x00000000074E0000-0x00000000074E8000-memory.dmp

Download

memory/852-122-0x0000000007590000-0x00000000075AA000-memory.dmp

Download

memory/852-119-0x00000000074B0000-0x00000000074C4000-memory.dmp

Download

memory/852-117-0x00000000074A0000-0x00000000074AE000-memory.dmp

Download

memory/852-113-0x0000000007460000-0x0000000007471000-memory.dmp

Download

memory/852-112-0x00000000074F0000-0x0000000007586000-memory.dmp

Download

memory/852-80-0x00000000049E0000-0x0000000004A16000-memory.dmp

Download

memory/852-81-0x0000000005090000-0x00000000056B8000-memory.dmp

Download

memory/852-82-0x00000000057B0000-0x00000000057D2000-memory.dmp

Download

memory/852-111-0x00000000072D0000-0x00000000072DA000-memory.dmp

Download

memory/852-83-0x0000000005850000-0x00000000058B6000-memory.dmp

Download

memory/852-93-0x0000000005930000-0x0000000005C84000-memory.dmp

Download

memory/852-94-0x0000000005F30000-0x0000000005F4E000-memory.dmp

Download

memory/852-110-0x0000000007260000-0x000000000727A000-memory.dmp

Download

memory/852-96-0x00000000070E0000-0x0000000007112000-memory.dmp

Download

memory/852-97-0x000000006FC60000-0x000000006FCAC000-memory.dmp

Download

memory/852-109-0x00000000078A0000-0x0000000007F1A000-memory.dmp

Download

memory/852-108-0x0000000007120000-0x00000000071C3000-memory.dmp

Download

memory/2332-78-0x00000000050D0000-0x00000000050DA000-memory.dmp

Download

memory/2332-79-0x00000000051A0000-0x0000000005206000-memory.dmp

Download

memory/2332-77-0x0000000004F10000-0x0000000004FA2000-memory.dmp

Download

memory/2332-76-0x0000000005580000-0x0000000005B24000-memory.dmp

Download

memory/2332-75-0x0000000000530000-0x000000000053C000-memory.dmp

Download

memory/4360-4-0x0000000000930000-0x0000000000982000-memory.dmp

Download

memory/4360-13-0x0000000000930000-0x0000000000982000-memory.dmp

Download

memory/4360-7-0x0000000000930000-0x0000000000982000-memory.dmp

Download

memory/4360-8-0x0000000000930000-0x0000000000982000-memory.dmp

Download