lumma | 0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097

Analysis

max time kernel
93s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097N.exe
Size

4.2MB
MD5

1cd42299a0a2d6e1e0418cfb1b4195f0
SHA1

ff213631bc4beb032a4f499c6a374cf44fcfb1bc
SHA256

0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097
SHA512

d4775e17e51106e2944cf6f2f8d6fd66e6b1d6db3af33fd19e7201454f7567ddc8ebf71ebad79e209cee0fd444c2f93f1d7f41bebbe861012579f5faaf61bf66
SSDEEP

98304:UWKT+M0e7zfdN9VCiHwHSdIfAI4JLtwwy5TZTsWPVxbtk9:Uv8WzfdN9V0ydEB4JLqb5TZTfPVxbtk9

Score

10^/10

lumma stealc tale credential_access discovery evasion persistence spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

tale

http://185.215.113.206

Attributes

url_path
/6c4adf523b719729.php

Extracted

Family

lumma

https://navygenerayk.store/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2l4352.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3X60S.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2l4352.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3X60S.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3X60S.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2l4352.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	3X60S.exe

Executes dropped EXE 4 IoCs

pid	Process
3688	f5D52.exe
2548	1h61G7.exe
2652	2l4352.exe
5432	3X60S.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	2l4352.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	3X60S.exe

Loads dropped DLL 1 IoCs

pid	Process
5432	3X60S.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	f5D52.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000b000000023b66-12.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2652	2l4352.exe
5432	3X60S.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2l4352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3X60S.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1h61G7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5D52.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3X60S.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3X60S.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5904	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2376	taskkill.exe
3340	taskkill.exe
4828	taskkill.exe
1516	taskkill.exe
3804	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2652	2l4352.exe
2652	2l4352.exe
5432	3X60S.exe
5432	3X60S.exe
5432	3X60S.exe
5432	3X60S.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	taskkill.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	3804	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	4184	firefox.exe
Token: SeDebugPrivilege	4184	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe
2548	1h61G7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4184	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3688	1444	0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097N.exe	84
PID 1444 wrote to memory of 3688	1444	0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097N.exe	84
PID 1444 wrote to memory of 3688	1444	0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097N.exe	84
PID 3688 wrote to memory of 2548	3688	f5D52.exe	86
PID 3688 wrote to memory of 2548	3688	f5D52.exe	86
PID 3688 wrote to memory of 2548	3688	f5D52.exe	86
PID 2548 wrote to memory of 3340	2548	1h61G7.exe	88
PID 2548 wrote to memory of 3340	2548	1h61G7.exe	88
PID 2548 wrote to memory of 3340	2548	1h61G7.exe	88
PID 2548 wrote to memory of 4828	2548	1h61G7.exe	94
PID 2548 wrote to memory of 4828	2548	1h61G7.exe	94
PID 2548 wrote to memory of 4828	2548	1h61G7.exe	94
PID 2548 wrote to memory of 1516	2548	1h61G7.exe	96
PID 2548 wrote to memory of 1516	2548	1h61G7.exe	96
PID 2548 wrote to memory of 1516	2548	1h61G7.exe	96
PID 2548 wrote to memory of 3804	2548	1h61G7.exe	98
PID 2548 wrote to memory of 3804	2548	1h61G7.exe	98
PID 2548 wrote to memory of 3804	2548	1h61G7.exe	98
PID 2548 wrote to memory of 2376	2548	1h61G7.exe	100
PID 2548 wrote to memory of 2376	2548	1h61G7.exe	100
PID 2548 wrote to memory of 2376	2548	1h61G7.exe	100
PID 2548 wrote to memory of 1264	2548	1h61G7.exe	102
PID 2548 wrote to memory of 1264	2548	1h61G7.exe	102
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 1264 wrote to memory of 4184	1264	firefox.exe	103
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105
PID 4184 wrote to memory of 3012	4184	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097N.exe
"C:\Users\Admin\AppData\Local\Temp\0d1117671114c9eea71961ca6224a0258e8df81f98e98df6b1002f7f77607097N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f5D52.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f5D52.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1h61G7.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1h61G7.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1264
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4184
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1964 -prefMapHandle 1956 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1c882c4-0227-47d1-a679-48382027cefc} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" gpu
        6⤵
        
        PID:3012
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2472 -parentBuildID 20240401114208 -prefsHandle 2464 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ef19cbe-bd96-4c4a-b1ed-65fc57f574a4} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" socket
        6⤵
        
        PID:4536
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2672 -childID 1 -isForBrowser -prefsHandle 2844 -prefMapHandle 2676 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d94e06c7-e76a-4467-b2c2-3ad6908dee46} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab
        6⤵
        
        PID:3132
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3960 -childID 2 -isForBrowser -prefsHandle 3952 -prefMapHandle 3948 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfd0b5b7-0ce3-4933-a409-bdac0bceecd0} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab
        6⤵
        
        PID:3108
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4516 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4540 -prefMapHandle 4536 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a01133aa-ca1d-463e-b35d-7d785ea1093d} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" utility
        6⤵
        Checks processor information in registry
        
        PID:4988
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 3 -isForBrowser -prefsHandle 5604 -prefMapHandle 4784 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af592219-3271-4027-a76c-3e550b2c3ad8} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab
        6⤵
        
        PID:2436
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5756 -childID 4 -isForBrowser -prefsHandle 5836 -prefMapHandle 5832 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {353744fd-ecdc-4ee3-b1fe-e15e4101e0b9} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab
        6⤵
        
        PID:400
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 5 -isForBrowser -prefsHandle 5964 -prefMapHandle 5968 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf3db241-93d6-4581-ae61-f7887d57c6da} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab
        6⤵
        
        PID:4784
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2l4352.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2l4352.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2652
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3X60S.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3X60S.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3X60S.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5808
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\chrome.dll

Filesize
676KB

MD5
eda18948a989176f4eebb175ce806255

SHA1
ff22a3d5f5fb705137f233c36622c79eab995897

SHA256
81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

SHA512
160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
b39712e0da27e37bfea38280e7866a5b

SHA1
247d66b70fb37581e5c117185ab453dc754580f2

SHA256
2774b9a564793f5dac3058a2ae485269428135e0aba0433e7b32163ad547045f

SHA512
97a1b8f1394fc1792b387034df6404173542202ba31abde9a9ed604f20b06efcb29af0357e8d12066ebbe03b92bc316761f2f7ab8addce275f46b06e924d7491

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Filesize
13KB

MD5
d549029be1f6d3d26ecf1eac46dcbe4b

SHA1
13b6e19b5abb9f98e54412a6121bc07f67afc754

SHA256
f550803ab278b5d82200b8a9f17a2fab56053c24c40744697006fc4f3f39c87a

SHA512
40db6597a36429c5d682ebe81fcfcee86fed70c3296dc911188d4dce7968a6da267f0cf8b3dd7405ff818e74dacc94e8bd889e901e62a3093a7f0d6617a1d8b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3X60S.exe

Filesize
2.0MB

MD5
2d64df3aeacd82bb685e92244bf2299a

SHA1
7da7725703a553aade9a2dac5b96944d62849bf8

SHA256
d7f4160811b116e305bff7508b10d6445564a8a9d42409817e73f8046230790c

SHA512
553b1f12af4278bf0714a56529f02402e43b4c7279cefb061c6c8899a97eea3e78eec6b8924baede51cdc1e9046c5086675e38986e5fa5f6a6e576913c4028b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f5D52.exe

Filesize
2.1MB

MD5
ac028d9d20a7a86cb41570be593d492b

SHA1
44902cea905766c45c2b3fab087a476b38ad1d09

SHA256
c5a4f7c92b8281dd4f3a147d9cfd069e5e022525734cda114ec500ff2b835ea3

SHA512
754e82c5f499b0ee09e44a236051c38618d179aa00435a9806f84c135cd2bc1474246c2eacaa325cb4318770e3b62ad3243225b3376e445571defba6b918a8fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1h61G7.exe

Filesize
898KB

MD5
fcd8204a8c028a65e963306268d6bc69

SHA1
2b5923716e2a3efe428040b6f576b6c4b4e17324

SHA256
2e29ab30a85eb61d61a0344e198e3b85ecccf52da236669d9e0302dec4f238ec

SHA512
e62f1b3214b7767dbc7f90803e722dec7fc2fe19347e9559565646ea0127636cb8b1ba2f3f155366c991de279b62d409aaf01d1f04f316048cc6cb1e6c25f345

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2l4352.exe

Filesize
3.0MB

MD5
ea96a1023099b2e8d55f5a9f1479cb06

SHA1
ceba33ab49e0bd7be19810d44a5576d7ac17aed2

SHA256
1a62d7d8e19970df7d386e5c72306d49ca8c8455aed153a1701db3574e8fa256

SHA512
9da8e289c6581b5cd5b4554a948773f73a17897d0ea320d3e38ca9d0f5e327bc086ab209f37f2cd2fec64df850bf673725357f32fdc691eb9924827df2c1214b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

Filesize
6KB

MD5
ad835f09ae0bba2e5885cf8b4585ddb3

SHA1
e6e149841e0d33e1bd62bbff88d9c1fdc964ace8

SHA256
6952eee1e007839e37b2a94a8ee7fb3f0013514bd4da6ff21ca0424e3d16a0dc

SHA512
dd0981bbe801d88b73ba2ec6d8a8147133dbbac3975aa98b09bd13b89208bf8985a73f126f3711db940deae9462f3ac40ed6f3c57bec300acbf40e11385e9c45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

Filesize
10KB

MD5
f0c128e48868263db6d82598b4f5568b

SHA1
a3f837ad41ff5f4c73a2d1969fbdb2691f84f6cf

SHA256
e5692ade4d29c6611a5a77eb4e50fb9a449ae8e6541be9a6f473ec81bca2b17e

SHA512
b2d0fe9652cb21059de4cf0c9a8995db089a36f2ad81361f862fad41471bc543ce34c02dd82f760ec1b990b25a27c5971f82b06bcd91240d9865038e2dcdd0b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

Filesize
23KB

MD5
076c5e842023a667929ae5cb0a170d86

SHA1
9ac746af5725be0f71367f05b79079996f7bc975

SHA256
379435ede131cb878130b46f363b1526cb1635567c201d6fe248d2f7cec34187

SHA512
78b8feffb9521c51fc898cc66011fb78d9e921a9f6ac416f1521ac27c8f368b1e7ee2789f54e148c64259f18d865d72e5bdeb2072558d6f913e4c8d973b6410d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

Filesize
15KB

MD5
eef170ad535cd59747d1c6750fd19960

SHA1
f5b90929630cabd6fd7b6453309d1e5d5204295e

SHA256
c2b93160fd0305340c460635b940e74fce42cebbbc49b5b95b77ca09aca26fd3

SHA512
3b3d8aab350fafec5daaede6563a60ce9ed9ccbf9e595282ffab589f020a4f70a844c022f493dacb3e0f1e9e335c4a0db5fb1cdc4ab388625ab1c3cf3f0aaf4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
26aaf275c325a6181aaa035f914d0d40

SHA1
204ea72ca34fd82eca80be57b2eb2a1d68f7e16b

SHA256
57b88c6c15fbb0e0c00cd7814080648f00470ddff5793ec73f80d5ee84068f1c

SHA512
40348826b8ca48e8641ecaeae4aaf2c0e838809f12d4a7fff2c48e99ad436c01f6c27f46976ba33617e16847dc230b631242c93a05866a5d3df431a06bd35be5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
905de4ea5a3c38822883f587efba0076

SHA1
fb811d7cdb8d7a84da3fbf798eea50173d863de8

SHA256
7156569f3581b265f061ae7452bb4a058c813a23bf5afcfce44f7c2a8c281c71

SHA512
bc904855441bc312231a53ac6826669c51f1edb62c67d4107a6f4903f9c4bf55a6e9ba043fc2d45c0bd41f463541c6126dc1d705965fa475f6b9eb1d1e1d5234

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
af89344f31db763404490a7cb8962380

SHA1
2bc86dd443d8770e47c9e86e159fb1dc1002c6e7

SHA256
9982479eae3e94214d006a60226d16fd476d9a62af788431ebcd1ec4e766b5c3

SHA512
552ba87f373620ffe76dbe07f919f879524ea07eb9bb8b9bd9a5bd50dc43ca2c8e8e27473de35c4c82161c16666dcef0b8cc18577894714d1094c7e94a4e8b11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
3ec69acbc60e5ac6178f3ff5b667cb9b

SHA1
6557385e02341151aff7e3f8341fb8287a91289c

SHA256
98fe4749071f8d1ee6c22f2a0dcda4244b1bf85cc93aeef3ec9f8c6fcda7b06a

SHA512
4ecb0cf718afc431fa4954f74d75fedcacc1e8aa69625490b7255e087826b3d4a6887efcbb7373757bd3e21ebf587c9c2b29919ff2da794fa40ebccafc39b164

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
4114a51a16193f2b3f15b256cd73bb72

SHA1
1b5bbca9add4a066deb7c6ba09d0ad6e60dc607b

SHA256
bd26473845cb9c79f4f2ba0041be25538355a0f9509c1d0c15b83d6549427631

SHA512
97cf798bbfa2db8fcbe9ecf3d16403b040069e6a9622705221ee9eccd2bdd111c072e447dba387769f67510e75018b15df23c818ea599751f811d0abc1bf548f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
529295d1798747784287b10f8bc52d04

SHA1
22fe6fe4d23101ddb3ecf9cfb25dc031fb949ce2

SHA256
e5b72372024dfeff1a9209a6056b79fa7b5f516de0551fc63479ac0c5c8bce3a

SHA512
5a65eb34d8bdd4bc9ec1b3a38c698cf7433fd47015ff76b4513cb2d9571fba415c25676b7b7b8785bc1263abe6d7a95cc29b22b74ff7b56ff0cb6ecf9d64c11e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
0bc04f5dd4ab001ad854db6737071839

SHA1
9e6db884c6cf0aae2a03f6f00570de7adbfd1635

SHA256
a04159c4bfaaf2b648fff8c4d1a934bf247954912de9afea55b1dfad73df0b4a

SHA512
dacd3b029b0c91ae75a0d24ee3bc24529c0bbb0ee22eae2af53e8f203d5aa741f5185a3b1e0d33c00d674636b105807e825e58c562fe5dda6b3a9962416c509b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\7b1e69ad-7e20-4c2b-a934-1a1cec78b159

Filesize
982B

MD5
d0e59eb7d373ed7bc07a52be218ed0b8

SHA1
6ff340bbe6c766022221e184bd0cc07da8db398e

SHA256
ece51e654ad2e3e0ae0c6fc8909c73601288704a0ad44fa9e94885d266aa545e

SHA512
06130974b084b639b6255b7f5409b0c4dc45758cde891abf34d45d77c983bbfeda67fe845629f6837090e1dc9795cc301f5addf0ec543cc25b072f9688a1d3f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\a5125678-50a6-4d79-9970-8ea3bac0aa16

Filesize
671B

MD5
5ffb7cf97260d1e79032df1ddf281189

SHA1
8bdf6cad3683bdee973ca1254036f082b83130df

SHA256
8a415fbd5387122b745b9f75f03b06c8cd7bb7654367caddca91f052a6c1ed7e

SHA512
43bd600668906beff4e40b6fb2714c30b200090fc36234ab56006c24854049a6657d10fd30617add0c16e3282ef6b019a477aa1e881e81a32bed6f79957d582e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\e0195b25-7b36-4b49-80be-d07f806a75cb

Filesize
26KB

MD5
8fdc2ad49bb3477031a673ab5ac5e56b

SHA1
72b66cd24c5eb1e86b98439db22169839eb0b493

SHA256
495abdcf69764a69a77fc98f5eb460f3cbc1da20064084c75b4ab0a9e17ddcf3

SHA512
cd9887b663e55e708cfb4156b45ece14b17ed21697f0a52890f9432e5d9acbc1834ffeac45c7199ad8356adf137e9ae787776c8961aa95ce42a4ba665fcf27be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

Filesize
12KB

MD5
73dd249c301e3fdb97596805abf8daa4

SHA1
e6fe9f1f46d571b091352e6e3382b6985b1d12d7

SHA256
9bc37f60f7079d404efec637fa22c7fb6f9dcafda82e86d4313d70e552d88697

SHA512
2c18ba55836b0051f2bfe2d59a22e7b264b54aa6882c0c45c189f8827bc88cc393424ac53fa7e8cde1a478dd8be98acc2ca2d954cc61ea4fc1940bf2eb8dd7c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

Filesize
15KB

MD5
8accb46611530e9b98c1a532c81335d2

SHA1
01cea37de27fe484f3a72c26eb09b2128a027966

SHA256
513a7d9b305217cc3ae93c4c7460cd598e808fa30d6577f0ae96faaacbddca0a

SHA512
2384b16fb5c0a250bec6983b1cdce0743f3d11671b0844fe0b3017b01a6979a71b5055820315a7e42b19acbe2c016c2fa68203237ae427eb82020a8235f4539b

Download Submit
memory/2652-727-0x0000000000020000-0x0000000000325000-memory.dmp

Filesize
3.0MB

Download
memory/2652-726-0x0000000000020000-0x0000000000325000-memory.dmp

Filesize
3.0MB

Download
memory/5432-746-0x0000000000D50000-0x0000000001477000-memory.dmp

Filesize
7.2MB

Download
memory/5432-731-0x0000000000D50000-0x0000000001477000-memory.dmp

Filesize
7.2MB

Download