lumma | 984d530e78ec72391f217805e5e078cef1c4e15c156c12d60841dae8b2e5af87

Resubmissions

02/08/2024, 02:50

240802-db3vrs1hpj10

02/08/2024, 02:47

240802-c9v25sweqe10

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240730-en
resource tags

arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
submitted
02/08/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 9.2MB
Sample240802-c9v25sweqe
SHA256 b16b380f60786a78e3e8760f4a65e0906f744e43b2a04eead206596727443082
MD5 1cc167273eeaf450abb5e548edfabc89
SHA1 ca47da5cc86c31aea84a6b170bc948f1020abe89
SHA512 99969849910f81ea0a163562502db3837e1cd506524c408938c12952c10e50ff846604cf5a0774014e0a896ba7c571c969ac168fd38002414dd7a87ed86749d7
SSDEEP 196608:Fsd7F8Iox9opRvxDKokM7JQpBgKDQhN0F:Fsd2px4lwrM7ClQhNu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://dividenntyss.shop/api
https://horizonvxjis.shop/api
https://effectivedoxzj.shop/api
https://parntorpkxzlp.shop/api
https://stimultaionsppzv.shop/api
https://grassytaisol.shop/api
https://broccoltisop.shop/api
https://shellfyyousdjz.shop/api
https://bravedreacisopm.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 5 IoCs

pid	Process
2008	Setup.tmp
2892	Setup.tmp
3972	ImPackr.exe
1208	ImPackr.exe
4924	StrCmp.exe

Loads dropped DLL 28 IoCs

pid	Process
2008	Setup.tmp
2892	Setup.tmp
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
3972	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
1164	Hypnotism.pif

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
3396	tasklist.exe
2540	tasklist.exe
1608	tasklist.exe
4640	tasklist.exe
4772	tasklist.exe
5116	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1208 set thread context of 784	1208	ImPackr.exe	115
PID 784 set thread context of 1164	784	more.com	117

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3768	1164	WerFault.exe	117
2012	1164	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ImPackr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ImPackr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StrCmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hypnotism.pif

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2308	ping.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION\ = "2.1"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\ = "BtDaemon.cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\Forward	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\LocalServer32	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\TypeLib	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\Implemented Categories	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\Forward	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ProgID\ = "BtDaemon.cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\ProtectLoad\\FACKEMXONZQPJ"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\Version = "2.1"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\Forward\ = "{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid32	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\ = "BtDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\ProtectLoad\\FACKEMXONZQPJ\\StrCmp.exe"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ = "cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid32	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\Clsid	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\Programmable	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\FLAGS	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\FLAGS\ = "0"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "_cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "_cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\Version = "2.1"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "__cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ = "BtDaemon.cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\Clsid\ = "{4F7FA487-8CC1-493E-AF0A-E7A294474F25}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\Version = "2.1"	StrCmp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2308	ping.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2892	Setup.tmp
2892	Setup.tmp
3972	ImPackr.exe
1208	ImPackr.exe
1208	ImPackr.exe
784	more.com
784	more.com

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1208	ImPackr.exe
784	more.com
784	more.com

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1608	tasklist.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeDebugPrivilege	4772	tasklist.exe
Token: SeDebugPrivilege	5116	tasklist.exe
Token: SeDebugPrivilege	3396	tasklist.exe
Token: SeDebugPrivilege	2540	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	Setup.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4924	StrCmp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2008	4572	Setup.exe	82
PID 4572 wrote to memory of 2008	4572	Setup.exe	82
PID 4572 wrote to memory of 2008	4572	Setup.exe	82
PID 2008 wrote to memory of 3308	2008	Setup.tmp	83
PID 2008 wrote to memory of 3308	2008	Setup.tmp	83
PID 2008 wrote to memory of 3308	2008	Setup.tmp	83
PID 3308 wrote to memory of 2892	3308	Setup.exe	84
PID 3308 wrote to memory of 2892	3308	Setup.exe	84
PID 3308 wrote to memory of 2892	3308	Setup.exe	84
PID 2892 wrote to memory of 2308	2892	Setup.tmp	85
PID 2892 wrote to memory of 2308	2892	Setup.tmp	85
PID 2892 wrote to memory of 4980	2892	Setup.tmp	87
PID 2892 wrote to memory of 4980	2892	Setup.tmp	87
PID 4980 wrote to memory of 1608	4980	cmd.exe	89
PID 4980 wrote to memory of 1608	4980	cmd.exe	89
PID 4980 wrote to memory of 2948	4980	cmd.exe	90
PID 4980 wrote to memory of 2948	4980	cmd.exe	90
PID 2892 wrote to memory of 4760	2892	Setup.tmp	92
PID 2892 wrote to memory of 4760	2892	Setup.tmp	92
PID 4760 wrote to memory of 4640	4760	cmd.exe	94
PID 4760 wrote to memory of 4640	4760	cmd.exe	94
PID 4760 wrote to memory of 3848	4760	cmd.exe	95
PID 4760 wrote to memory of 3848	4760	cmd.exe	95
PID 2892 wrote to memory of 4888	2892	Setup.tmp	96
PID 2892 wrote to memory of 4888	2892	Setup.tmp	96
PID 4888 wrote to memory of 4772	4888	cmd.exe	98
PID 4888 wrote to memory of 4772	4888	cmd.exe	98
PID 4888 wrote to memory of 2176	4888	cmd.exe	99
PID 4888 wrote to memory of 2176	4888	cmd.exe	99
PID 2892 wrote to memory of 3596	2892	Setup.tmp	100
PID 2892 wrote to memory of 3596	2892	Setup.tmp	100
PID 3596 wrote to memory of 5116	3596	cmd.exe	102
PID 3596 wrote to memory of 5116	3596	cmd.exe	102
PID 3596 wrote to memory of 1120	3596	cmd.exe	103
PID 3596 wrote to memory of 1120	3596	cmd.exe	103
PID 2892 wrote to memory of 2520	2892	Setup.tmp	104
PID 2892 wrote to memory of 2520	2892	Setup.tmp	104
PID 2520 wrote to memory of 3396	2520	cmd.exe	106
PID 2520 wrote to memory of 3396	2520	cmd.exe	106
PID 2520 wrote to memory of 4828	2520	cmd.exe	107
PID 2520 wrote to memory of 4828	2520	cmd.exe	107
PID 2892 wrote to memory of 2272	2892	Setup.tmp	108
PID 2892 wrote to memory of 2272	2892	Setup.tmp	108
PID 2272 wrote to memory of 2540	2272	cmd.exe	110
PID 2272 wrote to memory of 2540	2272	cmd.exe	110
PID 2272 wrote to memory of 432	2272	cmd.exe	111
PID 2272 wrote to memory of 432	2272	cmd.exe	111
PID 2892 wrote to memory of 3972	2892	Setup.tmp	112
PID 2892 wrote to memory of 3972	2892	Setup.tmp	112
PID 2892 wrote to memory of 3972	2892	Setup.tmp	112
PID 3972 wrote to memory of 1208	3972	ImPackr.exe	113
PID 3972 wrote to memory of 1208	3972	ImPackr.exe	113
PID 3972 wrote to memory of 1208	3972	ImPackr.exe	113
PID 1208 wrote to memory of 4924	1208	ImPackr.exe	114
PID 1208 wrote to memory of 4924	1208	ImPackr.exe	114
PID 1208 wrote to memory of 4924	1208	ImPackr.exe	114
PID 1208 wrote to memory of 784	1208	ImPackr.exe	115
PID 1208 wrote to memory of 784	1208	ImPackr.exe	115
PID 1208 wrote to memory of 784	1208	ImPackr.exe	115
PID 1208 wrote to memory of 784	1208	ImPackr.exe	115
PID 784 wrote to memory of 1164	784	more.com	117
PID 784 wrote to memory of 1164	784	more.com	117
PID 784 wrote to memory of 1164	784	more.com	117
PID 784 wrote to memory of 1164	784	more.com	117

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\is-RNBIE.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RNBIE.tmp\Setup.tmp" /SL5="$6013E,8764920,776192,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\is-EKS2L.tmp\Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EKS2L.tmp\Setup.tmp" /SL5="$500DE,8764920,776192,C:\Users\Admin\AppData\Local\Temp\Setup.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Windows\system32\ping.exe
        
        "ping" -n 6 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2308
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4980
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
      - C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        6⤵
        
        PID:2948
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4760
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4640
      - C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        6⤵
        
        PID:3848
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4888
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4772
      - C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        6⤵
        
        PID:2176
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3596
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5116
      - C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        6⤵
        
        PID:1120
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2520
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
      - C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        
        PID:4828
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2272
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2540
      - C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        
        PID:432
    - - C:\Users\Admin\AppData\Local\ptt\ImPackr.exe
        
        "C:\Users\Admin\AppData\Local\ptt\ImPackr.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3972
      - C:\Users\Admin\AppData\Roaming\ProtectLoad\ImPackr.exe
        
        C:\Users\Admin\AppData\Roaming\ProtectLoad\ImPackr.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Users\Admin\AppData\Roaming\ProtectLoad\FACKEMXONZQPJ\StrCmp.exe
        
        C:\Users\Admin\AppData\Roaming\ProtectLoad\FACKEMXONZQPJ\StrCmp.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4924
        
        C:\Windows\SysWOW64\more.com
        
        C:\Windows\SysWOW64\more.com
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Hypnotism.pif
        
        C:\Users\Admin\AppData\Local\Temp\Hypnotism.pif
        8⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1328
        9⤵
        Program crash
        
        PID:3768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1328
        9⤵
        Program crash
        
        PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 1164 -ip 1164
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1164 -ip 1164
1⤵
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hypnotism.pif

Path C:\Users\Admin\AppData\Local\Temp\Hypnotism.pif
Size 29KB
SHA256 a5a7183977808efbaa1ca3e55776f09bcae8f30e2aa5b0520c9cd88cd0d4997d
MD5 d0509de5ba78cdfb67f897b06d9d184d
SHA1 f3ea9fa41831739d38353167754c0bb5a9544001
SHA512 0cdfb02946e8450a057db69f3e4331adc2b1bffee2d6002ea2a1ba8b9964883dd71c6f5becd41c02a4a06fd84e20836348b56af3696ae21587a774ec75d9f2c5
SSDEEP 384:dscbVlMLd8bzzqzEG3VSUwy+FgkOawtMTJxOlJsBnYPL6x2UHeMaGeOUg5JNNzFT:dsGMLdvzEG30Uwy+wkHO70v9ec3wh
MD5 SHA1 SHA512 SSDEEP

Submit Download

e663bc6b

Path C:\Users\Admin\AppData\Local\Temp\e663bc6b
Size 1.1MB
SHA256 8666ccc8e0f60c8624b89c712cb820a5c4e48f0c6be8cb741279e95d21c1c426
MD5 37f081bc192b9747c010a825f87a63cf
SHA1 26ac614f2db2dd876f579f179d8708bdfdecddcb
SHA512 66edc6a8129cc1947459a8c8c6410658d030700019a26177c53686520aadd03c21ddd36b2a4408b4dbcae2f4155fc9299184ab8d93395261905cab81225d3824
SSDEEP 24576:Ru33YxSWGZ6xgvTUKC7Ng8Tet+4yuag1rsVDg6d5Xk3aG0Fa7/h6:RuHYZA54KC7q8Tet+4yuag1rsVDg6rkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-I8BL5.tmp\_isetup\_iscrypt.dll
Size 12KB
SHA256 4bb34fe74f86ab389763863ee395a93d73e2d9548c224819ec9055d7c8c4b480
MD5 47cfd05fde4babe79530c7ea730f6dc0
SHA1 2c055fa81f19d6f024f1f3d5b2dd0d5fde51d87e
SHA512 ece4b4268e0d346e438f6f59fe333f7b6f95e3287791c517ef477935704ad2788e544a877b39abf542cd90a23966302d44cf03fb71e95c4f84ea11e634b3cbd0
SSDEEP 192:8VT+PBo21ZtDYNDxEGRjDZ1t7r+51q5CMqrHPTSofousUwz2T3+4Doma:2N2mNDyeV7r+5w56SofousWu4DU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RNBIE.tmp\Setup.tmp
Size 3.0MB
SHA256 794e4135015d6507846a072f81168eaf297c78dbe529e4cc94ddbb475b43d694
MD5 0a8d31efde93f55df43e8a3cde98e8fa
SHA1 2df48a22c5cf85cad7cf320384ce5cea51f87cee
SHA512 ecca5f4883591481dad26daac8d8cae4e49644f86c2e3575c2fe3da9c567f75646ebda70bf23f600aa3570c8614093084773f88a29d58f8675cff44f83b438d0
SSDEEP 49152:0dJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdt6333T/:WJYVM+LtVt3P/KuGP+VYNCul6333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMHttpComm.dll

Path C:\Users\Admin\AppData\Local\ptt\IMHttpComm.dll
Size 32KB
SHA256 96d6264b26decf6595ca6f0584a1b60589ec5dacdf03ddf5fbb6104a6afc9e7a
MD5 a70d91a9fd7b65baa0355ee559098bd8
SHA1 546127579c06ae0ae4f63f216da422065a859e2f
SHA512 f13b735a47090c7c6cc6c2bf9148408ee6db179c96ee6428270541f27e50ad12cff7486f3a6ffac2ba83fd2e6e8e49661e6258f5aee97eb0f48771cbbd22aefa
SSDEEP 384:UYacYCuDAIKaDEsdpRPcWzXKNfdZ1uTslWfXLhxyM8OjrsVIObsU25hoe1nYPLMt:Scr9/i1AscZ1wf7h4bOjKRsIe1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImLookExU.dll

Path C:\Users\Admin\AppData\Local\ptt\ImLookExU.dll
Size 262KB
SHA256 34ba4b2ca63bbbf0c3be82787b11284d91b6050643c78e7d64d1d25544d72813
MD5 c8a5c9f0824b7132a54764b719b4f436
SHA1 09a92930aff829fb8df9f2856d7e615c3f185b50
SHA512 3848311ca0dd357d02cc07496ff5e5cbc6792e9e3e57afb28998269db7207685a742aea2ecc2196f4c5dbbc255bc8c42451e4bbd69a48ea6b97935d938c33db6
SSDEEP 6144:bX6y0xmY4o8xnZSYDI73zFlwzohvFl4OgqOLnFrzs:bX6y0xmY4pZSYkTzwMFkntzs
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImLookU.dll

Path C:\Users\Admin\AppData\Local\ptt\ImLookU.dll
Size 606KB
SHA256 a6766c524497144d585efa4fe384b516b563203427003508f7c8f6bffa7c928d
MD5 3ea6d805a18715f7368363dea3cd3f4c
SHA1 30ffafc1dd447172fa91404f07038d759c412464
SHA512 a102f23741de4ca2184485d9aa4ddd1a36b9ea52cb0859cfd264d69a9996293b7e29b325625f1f6f9330d6c80ff415e09e85e1ae838c58acef585ae8dffe3070
SSDEEP 6144:5hvkhcT5e0HWJ5/10UfCrXCL12gQhYwtHWDEyF0nb6rFBvJ+sbJeDH+8uGh7xgLX:5hvkhcTd2JxXCrS85h0Dh0nMKbz45
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImNtUtilU.dll

Path C:\Users\Admin\AppData\Local\ptt\ImNtUtilU.dll
Size 94KB
SHA256 a8e1b0e676dce9556037d29fd96521ec814858404ba4cfdd0db0edbe22c87bc7
MD5 bb326fe795e2c1c19cd79f320e169fd3
SHA1 1c1f2b8d98f01870455712e6eba26d77753adcac
SHA512 a1ec894151baa14e4ac1ee9471e8606bf74edd39f7833d9a1a44eee74d403f6b52780c135e9718ff9564fa27d7128c22b8410b21f77e6d804f698cfb4eda65a1
SSDEEP 1536:q01U2obLeNvXXZ6Wb/2LamjMkUYCTSZaKAxvSJKRDOAG921:NobLeNvXp6Ou+mjMkUYC2ZVAxxFOAG9s
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImPackr.exe

Path C:\Users\Admin\AppData\Local\ptt\ImPackr.exe
Size 102KB
SHA256 689951b03517f77b6c04bb57f604f50736dc1a86b87253b0dee73722d4520a11
MD5 2f779ac4318fd4990c828f60d16f2b17
SHA1 a188080158f8cdfe5050d6e828fb69e17ac0be19
SHA512 7f6dc79ab6db4615bb0c7b31d36cc8750373f9b7c199bfaa8e1eff9dbd6f0b790fe7e4c9dc86b62abb811d93e946e68ddc171701bddba423079447124ca6464c
SSDEEP 1536:BdPnjwBj/h13T5KRy8DiliMz+WPSC0mJcSs93k0TmOTWAnBchQlQICRXRXYu:BdPjwRrdoirza7C0iOPchc6Np
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImUtilsU.dll

Path C:\Users\Admin\AppData\Local\ptt\ImUtilsU.dll
Size 1.4MB
SHA256 914b1e53451b8be2c362d62514f28bdef46a133535d959b13f3f4bf3bc63df3a
MD5 a7eaba8bc12b2b7ec2a41a4d9e45008a
SHA1 6a96a18bb4f1cd6196517713ed634f37f6b0362b
SHA512 0ae7fbdb2677d92c62337aa17b60a4887240a4a426ba638c7633587f4582adbcda2bde5ec824aab1a3f69acf2b391118763842acfab856d3d9764850961a2ac8
SSDEEP 24576:2EQirQajY+S5eqyL9dj7GP4a6xKlnNYndIA1HVtFyC0Glqb6WUOQZljMFbDG0:fQj+S5epJl7+eenN5+HVDD0bUOQPUbDP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImWrappU.dll

Path C:\Users\Admin\AppData\Local\ptt\ImWrappU.dll
Size 158KB
SHA256 7187903a9e4078f4d31f4b709a59d24eb6b417ea289f4f28eabce1ea2e713dce
MD5 cbf4827a5920a5f02c50f78ed46d0319
SHA1 b035770e9d9283c61f8f8bbc041e3add0197de7b
SHA512 d1a285fb630f55df700a74e5222546656de7d2da7e1419e2936078340767d0bab343b603ba0d07140c790eb5d79a8a34b7818b90316ea06cb9f53cad86b6d3f5
SSDEEP 1536:+Vcm093l7KjJdwXjCsZ+WymDAZZxgbgROgldJ+VEcn75A:+Vcm03ggjCsZDym6Og5+Vpm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VC80.CRT.manifest

Path C:\Users\Admin\AppData\Local\ptt\Microsoft.VC80.CRT.manifest
Size 1KB
SHA256 17ad1a64ba1c382abf89341b40950f9b31f95015c6b0d3e25925bfebc1b53eb5
MD5 541423a06efdcd4e4554c719061f82cf
SHA1 2e12c6df7352c3ed3c61a45baf68eace1cc9546e
SHA512 11cf735dcddba72babb9de8f59e0c180a9fec8268cbfca09d17d8535f1b92c17bf32acda86499e420cbe7763a96d6067feb67fa1ed745067ab326fd5b84188c6
MD5 SHA1 SHA512

Submit Download

Microsoft.VC80.MFC.manifest

Path C:\Users\Admin\AppData\Local\ptt\Microsoft.VC80.MFC.manifest
Size 2KB
SHA256 4ed3ba814de7fd08b4e4c6143d144e603536c343602e1071803b86e58391be36
MD5 97b859f11538bbe20f17dfb9c0979a1c
SHA1 2593ad721d7be3821fd0b40611a467db97be8547
SHA512 905c7879df47559ad271dc052ef8ae38555eac49e8ac516bc011624bf9a622eb10ee5c6a06fbd3e5c0fa956a0d38f03f6808c1c58ee57813818fe8b8319a3541
MD5 SHA1 SHA512

Submit Download

SftTree_IX86_U_60.dll

Path C:\Users\Admin\AppData\Local\ptt\SftTree_IX86_U_60.dll
Size 570KB
SHA256 24f2399fc83198ab8d63ee6a1ad6ffbd1eda4d38048d3e809fecd2a3e0709671
MD5 57bf106e5ec51b703b83b69a402dc39f
SHA1 bd4cfab7c50318607326504cc877c0bc84ef56ef
SHA512 8bf60649ece6bbb66c7b94ed0d9214fbeab030d5813e1e7b5d6d2349ee1de9075b7dfbbbbeae5af0dc21b071a00eafce0771ca1804e6752e9a71e71e6b1447df
SSDEEP 6144:+F1oCaK7hWLMxQqTxNEaPe/cq0sJBJYzlRtcChgWPQnjLkV3Ij9DvAmintVM:koxK7hhNN1m/cq0sJ/YzNcCj0oVy8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

mfc80u.dll

Path C:\Users\Admin\AppData\Local\ptt\mfc80u.dll
Size 1.0MB
SHA256 18be5d3c656236b7e3cd6d619d62496fe3e7f66bf2859e460f8ac3d1a6bdaa9a
MD5 ccc2e312486ae6b80970211da472268b
SHA1 025b52ff11627760f7006510e9a521b554230fee
SHA512 d6892abb1a85b9cf0fc6abe1c3aca6c46fc47541dffc2b75f311e8d2c9c1d367f265599456bd77be0e2b6d20c6c22ff5f0c46e7d9ba22c847ad1cbedc8ca3eff
SSDEEP 12288:o5lk6KUYmYRP6vAt9+J51r64f22JhPeEiz8F+p/xoOTa+S9XqNNw2ohW3:UyUaP64t9+JfrRJiz8F+p/N2/cmW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp80.dll

Path C:\Users\Admin\AppData\Local\ptt\msvcp80.dll
Size 536KB
SHA256 2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
MD5 4c8a880eabc0b4d462cc4b2472116ea1
SHA1 d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA512 6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
SSDEEP 12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr80.dll

Path C:\Users\Admin\AppData\Local\ptt\msvcr80.dll
Size 612KB
SHA256 02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9
MD5 e4fece18310e23b1d8fee993e35e7a6f
SHA1 9fd3a7f0522d36c2bf0e64fc510c6eea3603b564
SHA512 2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc
SSDEEP 12288:6Fqi2VC1J7Zs7a5zchr46CIfsyZmGyYCqeC:6Ui2C1JdoiEdmGyYu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pegmatite.mp4

Path C:\Users\Admin\AppData\Local\ptt\pegmatite.mp4
Size 28KB
SHA256 b18318487981c68e812f3ac0adb5eb39c019d66da83e2ba15084ad8e836f9bbf
MD5 c16bdb0036083aba512460a356e5fc84
SHA1 20dbacf9718f981b1e3b21980662a3e634cf39a8
SHA512 ed55801bbb73fa8ddffe6f0b67d8f4beea4e8f3503c7e93845573c4589af41e7a489f8b67fe8073be0378719fd96d66b6773cd0ed2703f4167e7824fa7b58071
SSDEEP 768:mmW5L2p9CZ5felxmbp3gjJZRvsAv5HVbBtodAmME:6pSxmbpQFvXh1r0AmME
MD5 SHA1 SHA512 SSDEEP

Submit Download

tanh.pdf

Path C:\Users\Admin\AppData\Local\ptt\tanh.pdf
Size 907KB
SHA256 17edad4451044460a570aa31cc5976ac8d4b5f5a0fb73548eb811c6d1b1e01b9
MD5 a2c4a4c8839fba9933013dd48d65857c
SHA1 a94ece2f5c6a95b974b9e456be0112c91d5e51b8
SHA512 860c036475b4a2ebff95fe4ea4fe8a3259e7777639e812d31167e4ec9f4447f1c15abef3b14776bec0305dcc0fa1db43cb2a376babdf6d6eb5e6d5e2c85e57a7
SSDEEP 24576:HZuU9iPHPYQ3eGUpxbPL5avjSlkcWeR/b:5uUQbHUn5cykXeRj
MD5 SHA1 SHA512 SSDEEP

Submit Download

wlessfp1.dll

Path C:\Users\Admin\AppData\Local\ptt\wlessfp1.dll
Size 70KB
SHA256 fbd4b6011d3d1c2af22827ca548ba19669eef31173d496e75f064ef7a884431c
MD5 5120c44f241a12a3d5a3e87856477c13
SHA1 cd8a6ef728c48e17d570c8dc582ec49e17104f6d
SHA512 67c0e718368e950d42f007d6a21c6f903b084d6514f777b86aab3111ffe3be995949674276081c0281139a0b39119b84630a0ac341d4ae78677ac8346f371ae1
SSDEEP 1536:nEqYKdOEuqRKXd9ZWbIOinToIfYeyOgtPko:EqnB89ZouTBf5yOgtPko
MD5 SHA1 SHA512 SSDEEP

Submit Download

StrCmp.exe

Path C:\Users\Admin\AppData\Roaming\ProtectLoad\FACKEMXONZQPJ\StrCmp.exe
Size 47KB
SHA256 118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35
MD5 916d7425a559aaa77f640710a65f9182
SHA1 23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13
SHA512 d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc
SSDEEP 384:UIJpPkn2VDVdOQe7vB4LN9tntl4crAlRcDuy1Tyk6K/uLvVWuFRNV1VF0hXHMGBJ:UQ35YtUIbERx/6jjVTbV1VaXLkjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/784-172-0x00007FFF2E7A0000-0x00007FFF2E9A9000-memory.dmp

Download

memory/784-174-0x0000000073C60000-0x0000000073DDD000-memory.dmp

Download

memory/1164-181-0x0000000000F70000-0x0000000000FDD000-memory.dmp

Download

memory/1164-180-0x00007FFF2E7A0000-0x00007FFF2E9A9000-memory.dmp

Download

memory/1164-177-0x0000000072640000-0x0000000073957000-memory.dmp

Download

memory/1164-182-0x0000000000F70000-0x0000000000FDD000-memory.dmp

Download

memory/1208-162-0x0000000073C60000-0x0000000073DDD000-memory.dmp

Download

memory/1208-154-0x0000000000680000-0x0000000000690000-memory.dmp

Download

memory/1208-159-0x0000000073C60000-0x0000000073DDD000-memory.dmp

Download

memory/1208-160-0x00007FFF2E7A0000-0x00007FFF2E9A9000-memory.dmp

Download

memory/1208-168-0x0000000073C60000-0x0000000073DDD000-memory.dmp

Download

memory/2008-17-0x0000000000400000-0x0000000000706000-memory.dmp

Download

memory/2008-8-0x0000000000400000-0x0000000000706000-memory.dmp

Download

memory/2892-102-0x0000000000400000-0x0000000000706000-memory.dmp

Download

memory/3308-105-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3308-13-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3308-15-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3972-99-0x0000000000B00000-0x0000000000B10000-memory.dmp

Download

memory/3972-109-0x00007FFF2E7A0000-0x00007FFF2E9A9000-memory.dmp

Download

memory/3972-108-0x0000000074970000-0x0000000074AED000-memory.dmp

Download

memory/4572-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Download

memory/4572-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4572-20-0x0000000000400000-0x00000000004CB000-memory.dmp

Download