lumma | d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe
Size

283KB
MD5

1a8eac6293ff78c7b9069e87830cc8c7
SHA1

6d73f90761d45ac64e9f6eb36da1e82756f2cee7
SHA256

d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53
SHA512

9f53782d65ee9d25537f7e0b075aa1df1c430f1c416014ebf4d10970ab504c388799068da07e78dfec7de4bf21457deb7f3c81f64a25b6e5b2872f85fa2472ae
SSDEEP

6144:DMsGCiIVbgS/z41Pj2Hlmu8VsLIIiRHTHKJlo9agrEO:D/GCiibh7OiHlB8VsLI1rbEO

Score

10^/10

lumma stealc vidar default credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

http://147.45.126.10:80

https://t.me/edm0d

https://steamcommunity.com/profiles/76561199768374681

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Extracted

Family

stealc

Botnet

default

http://46.8.231.109

Attributes

url_path
/c4754d4f680ead72.php

Extracted

Family

lumma

https://grassemenwji.shop/api

https://complainnykso.shop/api

https://basedsymsotp.shop/api

https://charistmatwio.shop/api

https://stitchmiscpaew.shop/api

https://commisionipwn.shop/api

Signatures

Detect Vidar Stealer 20 IoCs

stealer

resource	yara_rule
behavioral2/memory/536-3-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-9-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-7-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-23-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-24-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-40-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-41-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-57-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-58-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-82-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-83-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-90-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/536-91-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-167-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-163-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-165-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-254-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-255-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-270-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-271-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 3 IoCs

pid	Process
2708	BGDBAKFCFH.exe
3828	HCGDGIDGIJ.exe
3272	AFHJJEHIEB.exe

Loads dropped DLL 4 IoCs

pid	Process
536	RegAsm.exe
536	RegAsm.exe
4372	RegAsm.exe
4372	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3524 set thread context of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 2708 set thread context of 916	2708	BGDBAKFCFH.exe	99
PID 3828 set thread context of 4372	3828	HCGDGIDGIJ.exe	104
PID 3272 set thread context of 4912	3272	AFHJJEHIEB.exe	107

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BGDBAKFCFH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AFHJJEHIEB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCGDGIDGIJ.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1856	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
536	RegAsm.exe
536	RegAsm.exe
536	RegAsm.exe
536	RegAsm.exe
536	RegAsm.exe
536	RegAsm.exe
4372	RegAsm.exe
4372	RegAsm.exe
536	RegAsm.exe
536	RegAsm.exe
4912	RegAsm.exe
4912	RegAsm.exe
4372	RegAsm.exe
4372	RegAsm.exe
4912	RegAsm.exe
4912	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1616	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	84
PID 3524 wrote to memory of 1616	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	84
PID 3524 wrote to memory of 1616	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	84
PID 3524 wrote to memory of 3192	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	85
PID 3524 wrote to memory of 3192	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	85
PID 3524 wrote to memory of 3192	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	85
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 3524 wrote to memory of 536	3524	d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe	86
PID 536 wrote to memory of 2708	536	RegAsm.exe	96
PID 536 wrote to memory of 2708	536	RegAsm.exe	96
PID 536 wrote to memory of 2708	536	RegAsm.exe	96
PID 2708 wrote to memory of 916	2708	BGDBAKFCFH.exe	99
PID 2708 wrote to memory of 916	2708	BGDBAKFCFH.exe	99
PID 2708 wrote to memory of 916	2708	BGDBAKFCFH.exe	99
PID 2708 wrote to memory of 916	2708	BGDBAKFCFH.exe	99
PID 2708 wrote to memory of 916	2708	BGDBAKFCFH.exe	99
PID 2708 wrote to memory of 916	2708	BGDBAKFCFH.exe	99
PID 2708 wrote to memory of 916	2708	BGDBAKFCFH.exe	99
PID 2708 wrote to memory of 916	2708	BGDBAKFCFH.exe	99
PID 2708 wrote to memory of 916	2708	BGDBAKFCFH.exe	99
PID 536 wrote to memory of 3828	536	RegAsm.exe	100
PID 536 wrote to memory of 3828	536	RegAsm.exe	100
PID 536 wrote to memory of 3828	536	RegAsm.exe	100
PID 3828 wrote to memory of 2232	3828	HCGDGIDGIJ.exe	102
PID 3828 wrote to memory of 2232	3828	HCGDGIDGIJ.exe	102
PID 3828 wrote to memory of 2232	3828	HCGDGIDGIJ.exe	102
PID 3828 wrote to memory of 4928	3828	HCGDGIDGIJ.exe	103
PID 3828 wrote to memory of 4928	3828	HCGDGIDGIJ.exe	103
PID 3828 wrote to memory of 4928	3828	HCGDGIDGIJ.exe	103
PID 3828 wrote to memory of 4372	3828	HCGDGIDGIJ.exe	104
PID 3828 wrote to memory of 4372	3828	HCGDGIDGIJ.exe	104
PID 3828 wrote to memory of 4372	3828	HCGDGIDGIJ.exe	104
PID 3828 wrote to memory of 4372	3828	HCGDGIDGIJ.exe	104
PID 3828 wrote to memory of 4372	3828	HCGDGIDGIJ.exe	104
PID 3828 wrote to memory of 4372	3828	HCGDGIDGIJ.exe	104
PID 3828 wrote to memory of 4372	3828	HCGDGIDGIJ.exe	104
PID 3828 wrote to memory of 4372	3828	HCGDGIDGIJ.exe	104
PID 3828 wrote to memory of 4372	3828	HCGDGIDGIJ.exe	104
PID 536 wrote to memory of 3272	536	RegAsm.exe	105
PID 536 wrote to memory of 3272	536	RegAsm.exe	105
PID 536 wrote to memory of 3272	536	RegAsm.exe	105
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 3272 wrote to memory of 4912	3272	AFHJJEHIEB.exe	107
PID 536 wrote to memory of 4036	536	RegAsm.exe	108
PID 536 wrote to memory of 4036	536	RegAsm.exe	108
PID 536 wrote to memory of 4036	536	RegAsm.exe	108
PID 4036 wrote to memory of 1856	4036	cmd.exe	110
PID 4036 wrote to memory of 1856	4036	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe
"C:\Users\Admin\AppData\Local\Temp\d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\ProgramData\BGDBAKFCFH.exe
    "C:\ProgramData\BGDBAKFCFH.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:916
- - C:\ProgramData\HCGDGIDGIJ.exe
    "C:\ProgramData\HCGDGIDGIJ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2232
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4928
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks computer location settings
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4372
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminFCAAEBFHJJ.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminKFIEHIIIJD.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4116
- - C:\ProgramData\AFHJJEHIEB.exe
    "C:\ProgramData\AFHJJEHIEB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BKKJDBFBKKJE" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AFHJJEHIEB.exe

Filesize
282KB

MD5
5dd74b81e1e9f3ab155e1603a2fa793b

SHA1
653cdaf8617c7fdec6f39db3334e858bec9a2d66

SHA256
5756eb17961a1facf1f1c972dde0185932f10f7e7a6b3e756ac785418887eb26

SHA512
9017f6797f998423e3cd88dcf1086f6e555797a9e6414ffd714dcb394cfd3f2b2fb5432c9ba38792021b5ba9e421454385f509c9363cedb7d3ac5919f66035fa

Download Submit
C:\ProgramData\BFBGCFCFHCFHIECAEHDH

Filesize
11KB

MD5
e9856cb9442ce090a4892672775a00f7

SHA1
304d1d0bc889d0ae9c77f39f46ccfccab8c91447

SHA256
52a11336b9539b5ad2ad898435b05967e3b11b8a743219a34d18f0ba895066c6

SHA512
d8983f4afbda2e817c56c14ba9b20f50ce30f251dde028609324ca3b5dbb00eb5e27f74ebe90604f471821ecbb16329ccbfdcf1d4bdaa23d12c35abd516fedc6

Download Submit
C:\ProgramData\BGDBAKFCFH.exe

Filesize
321KB

MD5
c54262d9605b19cd8d417ad7bc075c11

SHA1
4c99d7bf05ac22bed6007ea3db6104f2472601fd

SHA256
de3f08aad971888269c60afcf81dc61f2158ca08cd32c9f5dd400e07d1517b54

SHA512
9c3086190bcb6ac9dd1ce22e69cfaf814d4acb60140fbe9e0cb220216d068d17151cb79f8acf89567c9a7b93960479ce19ea7b86020d939f56d6fc24e4d29a3f

Download Submit
C:\ProgramData\EGDGIEGH

Filesize
114KB

MD5
e228c51c082ab10d054c3ddc12f0d34c

SHA1
79b5574c9ce43d2195dcbfaf32015f473dfa4d2e

SHA256
02f65483e90802c728726ce1d16f2b405158f666c36e2c63090e27877ae4e309

SHA512
233ca5e06591e1646edfadb84a31bdfc12632fb73c47240a2109020accfbd1e337371bcc3340eae7a1f04140bbdeb0b416ce2de00fa85671671bb5f6c04aa822

Download Submit
C:\ProgramData\FIEHDBGDHDAE\FCAAEB

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\ProgramData\FIEHDBGDHDAE\FCAAEB

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\ProgramData\FIEHDBGDHDAE\FCAAEB

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\ProgramData\GIJEBKEC

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\ProgramData\HCGDGIDGIJ.exe

Filesize
205KB

MD5
003978c8812e39ddb74bf9d5005cb028

SHA1
126f73c30469a1b7e9a04a670c35185b5df628bc

SHA256
06510b52e07e89b5781f4ee3c7b4d94ff84c03931b3d7d93224294860feaccf4

SHA512
7c0b7ec7dfe18f99cf850c80c3228f52537d5565b2950d4f0ef8cbbb7b19d1f5e2d128f3766dcede41711b4d3c5631c7f758dd61697b1e5978d596f98f54c31d

Download Submit
C:\ProgramData\freebl3.dll

Filesize
54KB

MD5
6d8cc36e611685a64ce602f644ae7a3d

SHA1
21a28fca6d502bfd98e47e835eed6b27854bfc5e

SHA256
631695173ef391c291970ef72b766af7ed6891794e06d91d1af759e918d98d0f

SHA512
420fc4546d784e6fa5e4746840caf4df15375dfb4cbe6df3453423d0c598fd8d4f4e31ec9b70e11b477071d68a4ffaeafe98e12ea30265dd64f9e6481a32dd97

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\msvcp140.dll

Filesize
13KB

MD5
e416a22acaeff6cec5aa36a72becbede

SHA1
9fefce2eafd2e79ce0f0c60e2174b0052bfd0d2f

SHA256
edc0250d8dfe5b4049a64b6171d12ad701784f4650484d35315ab5286384e79e

SHA512
8ab549504e9c7f787e4ace97bcce5eed5bd9758b8cc223eae537e5ba3dc0f22ddd84802b1c43c2e947aa0a97742793b8cd09a5563ccd21820fa00bb5c1294421

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\softokn3.dll

Filesize
10KB

MD5
dcd1446dc9e539b6983c30064c32a1fd

SHA1
7d827027a4dcd3fb8d091369807f13f735f1f161

SHA256
6dcc35a5071877ad3e4428940f30623d708930b6b766a1f642b9a825ef58970c

SHA512
098f4f205cbc56d4357efd12a9ce5a96b5d6152d717f5503a1fd1f1d86deba71dc7dcdc3b1d0b0185c9d771de91e0eebd029670e35acaa8d60754af7716aa912

Download Submit
C:\Users\AdminFCAAEBFHJJ.exe

Filesize
1KB

MD5
c6a5abb575f4c14729b299058539998f

SHA1
90a8e0cfc7695944c9d28f3cf908ecbeb3367d0c

SHA256
7271dd5c11fb9a1052a5e91a09afbe7d148fd3388dc51c338df62a0a16f06739

SHA512
80fa0b7d01774d4a68e42ffd4b874c60a129684d86af168699905342e95af7ff7bc84559ea5a2619a600d75346b41664522b621b7bbe3fc7b5d14448568865af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0255CEC2C51D081EFF40366512890989_A2266F534D44FEE6BC8E990C542C69B4

Filesize
471B

MD5
a3a730aee52549b673746d0dbbc59531

SHA1
deb5b7d626272c1bc7b88f3476caaf1d64534972

SHA256
94ed1105931e5f86b887032ceb8b4f61e6f275487b7fa36220fd9ec520b82493

SHA512
354b4558b2a187117635e91d8d360c752c11844757be413349e5e701b1fa10294f55ea70053d49f46401bc4e7218991bde096d6c7179070963e636e3fccd3cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Filesize
2KB

MD5
3eb397a524d6b064f4130d706bbb32c9

SHA1
b79b1169cc971f21308e91af43a295c9cefcfd71

SHA256
ba7c039a117bca61feb4ede0876ff545248209cbcc30a8b08f4e84e894227a22

SHA512
40015805e1a585aac7c4a07a95a00f3808d99eb6080cd642dfe13d3a735f69dc54ed7381aa9cab498192c8af792c663ae4647597fd82cd96967cad464c5e75a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
2KB

MD5
8bd5a49df494d8ec0e300e48bc5ccac7

SHA1
1a5a88b912d7533e5f9d23c923c15e1a6e18a87e

SHA256
261b931e89a697f15f35ebe38faf32cb8b67ac3fe628ec8ac860c0e6e9b01464

SHA512
0e36c0c7ef6abe353ab46efccb296129239b355f873c8cf40ca210be2f6f5d2da89c1e6a5dc260beab7207529e9422748b87b04c7d72bce43b5b7342c4f7b6e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA

Filesize
2KB

MD5
ffec8069cabce0949aaee67665624e67

SHA1
d449a98b34103a9e80740ed9d7593c8115c3dc75

SHA256
340d048d7f46e25d83d97affa98d53d773e83e070b28ed67ea3472362a0a2993

SHA512
770d7b72772940699b4fb66ededa53a02fe580c5fcc5e050e2798e8e065c7a3505886d91d3ce05172e1d5c942069297934dd3c8c52f9e3d2be8f5d0c1ab851d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
1KB

MD5
67db8c5d484fe0b60abd574b0480e4c9

SHA1
bafea8ad167114a72854bfe78095155bb7c44f89

SHA256
5d2c8933104167dece16b77357813d01c861d0c00176057ab8fe93222b51141d

SHA512
5d71a6271cfdcbef50f51c083f1665baaa59e7d927051ec96086bc68ceb2334227d620ee777237fccb3954ae1a1691f79d7f73335e7c95179591a1cdd0e9c844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
1KB

MD5
267213063373c723fc10225ef5c35205

SHA1
405c393523c0341b508bed3bef206e10060aacd5

SHA256
fcd368cd3608e36d7cb22c98ea40b5c77feec34a08719fa136cef6db5e2036ec

SHA512
3a7cbd0ff672feea120d61c9b820727ec35a9345c5e6c5678e5140e1375a6881419e82a2b54528f39c4241bcdbdec3bf89c28288b217dfbb2d21ff8399c59032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0255CEC2C51D081EFF40366512890989_A2266F534D44FEE6BC8E990C542C69B4

Filesize
490B

MD5
3b4d32c080634294c4bf5be14f59fb37

SHA1
ce5bdd0e0945d8fc7354f4a19137ce1bb041d27e

SHA256
6cd88cff01450bc7b123b853f75062e994109636b6fbc62808243c0cec7b75a0

SHA512
83e7fa0315fc9328ef2a6500471ad0ccdf9967a071718bce2fd4f2a12bfcb81f73e10ae55c0b10af41a71479b6e963dc2b67f35e8622c9afc3f2dcd0264072a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Filesize
458B

MD5
060805ec5bc2b9acfe1e1dd7071450f0

SHA1
e723687c6568b2e3d065b8ae82e35c0f530022ea

SHA256
69c8e15d87d8e5d88cba8a1326f56807e47060dff7c68d13d1ab472c707e273d

SHA512
6bd70e13eb05f76fad870f3b8f90b78b97dd45545945a9259fdd00b09135d9c7e6712f41de70ca3a5fb8dd1a5fce5b5d9d1533e78b7f14e388b0e1d0b8a3a77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
52e90e9666ce1c612d3fef5883947cb4

SHA1
3660c8b9a5b43332fcb856c882cd0a34a2321426

SHA256
12b375bebb526fcf7e692d0bdf114104870b1be279803c48e2f7016349403db7

SHA512
783cd430b6dda5a85c10dd3f25f6028b5cc89978aafdda3b84ec42fc10ca2664d03afa8988d5cdfc9d0974559c90d236a4ff50ef0419c119b5eeef83ab7046b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA

Filesize
482B

MD5
7a13e62c57f488d277a30e39fdb0e133

SHA1
0a52c87001c313049c7e769a4512d8279414d6ce

SHA256
582f281ffae641a2804a0d76249b7561c544bc2d8374daa97837ff3873b29092

SHA512
f3aac40fdce914cc1a8941efc55e4b7d289a9059db304faa45f13d746bd7a13ad4f2c849966a856637cf35f99108ca7b797a0c0cdd62b9bed1f7373cfcace1a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
486B

MD5
269c212c09302dd32d316c3633280370

SHA1
1a21a429f265f4b5ebc800d26a7fa7c015449ff6

SHA256
5d2a97de03edeef768b944f5fb32efac6e0333688582ff0b8c655d631359b10c

SHA512
a69fbbe1e510e7dd24e19f9604ef3e9282adde752b7c9d7765469b29cfecb18460c8b2dfb589bec6f9de045bce4c845e993437ed8f6fd3ee81d5c0f111edd160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
458B

MD5
712623c62aeb449f6b00952a45aaaaa3

SHA1
4a8d8aa5a2d82318e50287b670c7cd6294f1811d

SHA256
19cceb42f9f3ea50fd7bbc68b36e5db5bd13df2461c6c450bb424ac7bcda0952

SHA512
af7a40a21128579575b3483c134ca5dd4f78d210e0f225738ed1a44723d5f17c1d9e8191feda401cdaf8eed4437f0c5f0bbdaf98a3c04831169fb6208c6d6dac

Download Submit
memory/536-83-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-9-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-3-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-7-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-23-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-24-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-25-0x00000000220A0000-0x00000000222FF000-memory.dmp

Filesize
2.4MB

Download
memory/536-40-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-41-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-57-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-58-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-82-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-90-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/536-91-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/916-118-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/916-125-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/916-122-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2708-126-0x0000000072880000-0x0000000073030000-memory.dmp

Filesize
7.7MB

Download
memory/2708-120-0x0000000072880000-0x0000000073030000-memory.dmp

Filesize
7.7MB

Download
memory/2708-114-0x000000007288E000-0x000000007288F000-memory.dmp

Filesize
4KB

Download
memory/2708-115-0x0000000000E00000-0x0000000000E54000-memory.dmp

Filesize
336KB

Download
memory/3272-160-0x0000000000E50000-0x0000000000E9A000-memory.dmp

Filesize
296KB

Download
memory/3524-0-0x000000007534E000-0x000000007534F000-memory.dmp

Filesize
4KB

Download
memory/3524-5-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/3524-1-0x0000000000C10000-0x0000000000C5A000-memory.dmp

Filesize
296KB

Download
memory/3828-140-0x0000000000C00000-0x0000000000C38000-memory.dmp

Filesize
224KB

Download
memory/4372-171-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4372-146-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4372-143-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4912-163-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/4912-255-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/4912-256-0x000000001C430000-0x000000001C68F000-memory.dmp

Filesize
2.4MB

Download
memory/4912-254-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/4912-270-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/4912-167-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/4912-165-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/4912-271-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download