lumma | 3e50b308a6366677b3fed9579f8f13dc721ae30b1534591c0ce5e083c1923a9f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/01/2025, 19:03 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Upd_156_983_15.msi
Size

1.3MB
MD5

0cd2b95df897bd2037edff092699e169
SHA1

18c5d3394d9260c2641e06a58847b7a2818b8174
SHA256

3e50b308a6366677b3fed9579f8f13dc721ae30b1534591c0ce5e083c1923a9f
SHA512

b3015d2beb30d841f0fc1a46baf7b56664c23e10538b519b791d9cc9fc86602811d52eb328c3d7e0832d5dece0019e01985e0e97a63037217574e475f93c95b1
SSDEEP

24576:3z+Xe8tCex83Si8UCROEYG3VKcoBR9RXawxz6X3pvtL7rPVU6fB6bAogJQOVe:3D8tCq83KFROEUcoBRqwxMpvt/rPVRB8

Score

10^/10

lumma discovery persistence privilege_escalation stealer

Malware Config

Extracted

Family

lumma

https://handlequarte.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Blocklisted process makes network request 12 IoCs

flow	pid	Process
3	3064	cmd.exe
5	3064	cmd.exe
7	3064	cmd.exe
9	3064	cmd.exe
11	3064	cmd.exe
13	3064	cmd.exe
15	3064	cmd.exe
17	3064	cmd.exe
19	3064	cmd.exe
21	3064	cmd.exe
23	3064	cmd.exe
25	3064	cmd.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 3064	2664	steamerrorreporter64.exe	37

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f76d55c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d55a.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSID633.tmp	msiexec.exe
File created	C:\Windows\Installer\f76d55a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76d559.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d559.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1972	steamerrorreporter64.exe
2664	steamerrorreporter64.exe

Loads dropped DLL 6 IoCs

pid	Process
2760	msiexec.exe
1972	steamerrorreporter64.exe
1972	steamerrorreporter64.exe
1972	steamerrorreporter64.exe
2664	steamerrorreporter64.exe
2664	steamerrorreporter64.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1624	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	cmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2760	msiexec.exe
2760	msiexec.exe
1972	steamerrorreporter64.exe
2664	steamerrorreporter64.exe
2664	steamerrorreporter64.exe
3064	cmd.exe
3064	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2664	steamerrorreporter64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1624	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeSecurityPrivilege	2760	msiexec.exe
Token: SeCreateTokenPrivilege	1624	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1624	msiexec.exe
Token: SeLockMemoryPrivilege	1624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1624	msiexec.exe
Token: SeMachineAccountPrivilege	1624	msiexec.exe
Token: SeTcbPrivilege	1624	msiexec.exe
Token: SeSecurityPrivilege	1624	msiexec.exe
Token: SeTakeOwnershipPrivilege	1624	msiexec.exe
Token: SeLoadDriverPrivilege	1624	msiexec.exe
Token: SeSystemProfilePrivilege	1624	msiexec.exe
Token: SeSystemtimePrivilege	1624	msiexec.exe
Token: SeProfSingleProcessPrivilege	1624	msiexec.exe
Token: SeIncBasePriorityPrivilege	1624	msiexec.exe
Token: SeCreatePagefilePrivilege	1624	msiexec.exe
Token: SeCreatePermanentPrivilege	1624	msiexec.exe
Token: SeBackupPrivilege	1624	msiexec.exe
Token: SeRestorePrivilege	1624	msiexec.exe
Token: SeShutdownPrivilege	1624	msiexec.exe
Token: SeDebugPrivilege	1624	msiexec.exe
Token: SeAuditPrivilege	1624	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1624	msiexec.exe
Token: SeChangeNotifyPrivilege	1624	msiexec.exe
Token: SeRemoteShutdownPrivilege	1624	msiexec.exe
Token: SeUndockPrivilege	1624	msiexec.exe
Token: SeSyncAgentPrivilege	1624	msiexec.exe
Token: SeEnableDelegationPrivilege	1624	msiexec.exe
Token: SeManageVolumePrivilege	1624	msiexec.exe
Token: SeImpersonatePrivilege	1624	msiexec.exe
Token: SeCreateGlobalPrivilege	1624	msiexec.exe
Token: SeBackupPrivilege	576	vssvc.exe
Token: SeRestorePrivilege	576	vssvc.exe
Token: SeAuditPrivilege	576	vssvc.exe
Token: SeBackupPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2304	DrvInst.exe
Token: SeRestorePrivilege	2304	DrvInst.exe
Token: SeRestorePrivilege	2304	DrvInst.exe
Token: SeRestorePrivilege	2304	DrvInst.exe
Token: SeRestorePrivilege	2304	DrvInst.exe
Token: SeRestorePrivilege	2304	DrvInst.exe
Token: SeRestorePrivilege	2304	DrvInst.exe
Token: SeLoadDriverPrivilege	2304	DrvInst.exe
Token: SeLoadDriverPrivilege	2304	DrvInst.exe
Token: SeLoadDriverPrivilege	2304	DrvInst.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1624	msiexec.exe
1624	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 1972	2760	msiexec.exe	35
PID 2760 wrote to memory of 1972	2760	msiexec.exe	35
PID 2760 wrote to memory of 1972	2760	msiexec.exe	35
PID 1972 wrote to memory of 2664	1972	steamerrorreporter64.exe	36
PID 1972 wrote to memory of 2664	1972	steamerrorreporter64.exe	36
PID 1972 wrote to memory of 2664	1972	steamerrorreporter64.exe	36
PID 2664 wrote to memory of 3064	2664	steamerrorreporter64.exe	37
PID 2664 wrote to memory of 3064	2664	steamerrorreporter64.exe	37
PID 2664 wrote to memory of 3064	2664	steamerrorreporter64.exe	37
PID 2664 wrote to memory of 3064	2664	steamerrorreporter64.exe	37
PID 2664 wrote to memory of 3064	2664	steamerrorreporter64.exe	37

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Upd_156_983_15.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1624

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\Arrivisme\steamerrorreporter64.exe
  "C:\Users\Admin\AppData\Local\Temp\Arrivisme\steamerrorreporter64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Users\Admin\AppData\Roaming\FMNbg\steamerrorreporter64.exe
    C:\Users\Admin\AppData\Roaming\FMNbg\steamerrorreporter64.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Blocklisted process makes network request
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:3064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E8" "0000000000000324"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2304

Network

DNS

handlequarte.shop

cmd.exe

Remote address:

8.8.8.8:53

Request

handlequarte.shop

IN A

Response

handlequarte.shop

IN A

172.67.186.121

handlequarte.shop

IN A

104.21.19.140
POST

https://handlequarte.shop/api

cmd.exe

Remote address:

172.67.186.121:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: handlequarte.shop

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:13 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=beq8kipcsudv203sole2bi6ukn; expires=Sat, 10 May 2025 12:50:52 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RqOmaYs4hWfzoHXveU2SId2qr4%2FUiXxgWOmRvY4pYbl0%2B6pQOXuNbrqH15MwGCSO41tp3aFKvFfEVtP3bSYTk6ePjBDb5mLaxUaO8WdJr6%2BxpRaIh2w2y9I4V%2FOes%2FIxSKZtgA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe3fb4d7076ef-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=67198&min_rtt=48286&rtt_var=46839&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2859&recv_bytes=585&delivery_rate=69820&cwnd=251&unsent_bytes=0&cid=76c66496d0592c4a&ts=427&x=0"
DNS

strivehelpeu.bond

cmd.exe

Remote address:

8.8.8.8:53

Request

strivehelpeu.bond

IN A

Response

strivehelpeu.bond

IN A

104.21.49.103

strivehelpeu.bond

IN A

172.67.161.160
POST

https://strivehelpeu.bond/api

cmd.exe

Remote address:

104.21.49.103:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: strivehelpeu.bond

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:13 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=1if63kkdainbeucc4vgs82q2aa; expires=Sat, 10 May 2025 12:50:52 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jXGgAo7i5deqkALrmJhUlrJNV4LrxJPmr7RspKWmU%2FdcACYIfgWCoKwpvaJ%2FxNiiC4yLF5L8eWNkfH9oKEb1sQ41Dj5gdW%2B%2BYr6XpqBvl25R9AYYmHuAWYAcNLk1wg7dnBOSbA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe3fe1c0fef15-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=48832&min_rtt=47224&rtt_var=12549&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2861&recv_bytes=585&delivery_rate=75911&cwnd=253&unsent_bytes=0&cid=16968849acadd68a&ts=282&x=0"
DNS

crookedfoshe.bond

cmd.exe

Remote address:

8.8.8.8:53

Request

crookedfoshe.bond

IN A

Response

crookedfoshe.bond

IN A

104.21.96.1

crookedfoshe.bond

IN A

104.21.112.1

crookedfoshe.bond

IN A

104.21.48.1

crookedfoshe.bond

IN A

104.21.64.1

crookedfoshe.bond

IN A

104.21.32.1

crookedfoshe.bond

IN A

104.21.80.1

crookedfoshe.bond

IN A

104.21.16.1
POST

https://crookedfoshe.bond/api

cmd.exe

Remote address:

104.21.96.1:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: crookedfoshe.bond

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=cm565aiinls7t61cvevoej2en4; expires=Sat, 10 May 2025 12:50:53 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pj%2FgTHn4puwVNmryRBwwS5QKLtP52Xi3%2Fm2If9teGniZv5tS4Jf7UdvqeCUGEdW7qywbEIACgs6HeGq%2FPFUTy2G3UweqUjVtNQML2n6fXJYdVZnPjtZJTXAIrgOVYgFeprJu9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe400de34ef1b-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=48489&min_rtt=47020&rtt_var=12583&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2859&recv_bytes=585&delivery_rate=79379&cwnd=253&unsent_bytes=0&cid=0db6b7b7e6c23319&ts=280&x=0"
DNS

immolatechallen.bond

cmd.exe

Remote address:

8.8.8.8:53

Request

immolatechallen.bond

IN A

Response

immolatechallen.bond

IN A

104.21.32.87

immolatechallen.bond

IN A

172.67.185.74
POST

https://immolatechallen.bond/api

cmd.exe

Remote address:

104.21.32.87:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: immolatechallen.bond

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=5p93ibho467b208cugai0a65ck; expires=Sat, 10 May 2025 12:50:53 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MqYcpJAkR6tPpkANlJNWzduPnZXB2dwagNAqNjpubBaxrWc%2Bm0b%2FDp5GKPc5UaMoPFi8n4OXOLqEQcHs73AEaJs%2BmQyvWC1Sk5T3UUaqavrjvsAbPvOZsMqH5u6KtFpZjTzupzNoOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe403a847cd1c-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=49044&min_rtt=47555&rtt_var=12381&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2870&recv_bytes=588&delivery_rate=78837&cwnd=253&unsent_bytes=0&cid=535caa3c9bff7917&ts=295&x=0"
DNS

stripedre-lot.bond

cmd.exe

Remote address:

8.8.8.8:53

Request

stripedre-lot.bond

IN A

Response

stripedre-lot.bond

IN A

104.21.55.3

stripedre-lot.bond

IN A

172.67.143.194
POST

https://stripedre-lot.bond/api

cmd.exe

Remote address:

104.21.55.3:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: stripedre-lot.bond

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=hjdqrf6rc5dtlv5ptkv48fifhk; expires=Sat, 10 May 2025 12:50:54 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7bW6hPAp%2FGWDPhplcXGUMbcl8sULsQOGsvv2x6RXXZ3tEBJHYth1Hl3unfVonfSOhAnNqnKg48%2BOqicrLy%2FTzWUz1IoCaCzuVd6Yr7YZibQvS%2FopRHNvqNJas%2BUH0nNudR8iv1g%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe4068eca9488-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=49053&min_rtt=47450&rtt_var=12811&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2865&recv_bytes=586&delivery_rate=75552&cwnd=252&unsent_bytes=0&cid=cf9b5ea249df3f83&ts=303&x=0"
DNS

growthselec.bond

cmd.exe

Remote address:

8.8.8.8:53

Request

growthselec.bond

IN A

Response

growthselec.bond

IN A

104.21.48.1

growthselec.bond

IN A

104.21.96.1

growthselec.bond

IN A

104.21.32.1

growthselec.bond

IN A

104.21.80.1

growthselec.bond

IN A

104.21.112.1

growthselec.bond

IN A

104.21.64.1

growthselec.bond

IN A

104.21.16.1
POST

https://growthselec.bond/api

cmd.exe

Remote address:

104.21.48.1:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: growthselec.bond

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=1161tmnn88bt78ee7c5biqinfv; expires=Sat, 10 May 2025 12:50:54 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W3xszKLdwHB6AFWYb1O%2BI9Uv6cQia0HZLkxhWcvVlXYhX0o43cLakoam3mlkCZTXbVFFak5IDTyWrnsDbcM9R%2FmkYIsYI%2BASh%2BfZEwt%2B1JiKibL74Vt1XTqfiiTMHFtvjpah"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe4097c6848c8-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=49427&min_rtt=46937&rtt_var=13747&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2856&recv_bytes=584&delivery_rate=67822&cwnd=238&unsent_bytes=0&cid=94175f77a50fd9b3&ts=309&x=0"
DNS

jarry-deatile.bond

cmd.exe

Remote address:

8.8.8.8:53

Request

jarry-deatile.bond

IN A

Response

jarry-deatile.bond

IN A

104.21.40.131

jarry-deatile.bond

IN A

172.67.151.242
POST

https://jarry-deatile.bond/api

cmd.exe

Remote address:

104.21.40.131:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: jarry-deatile.bond

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:16 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=ddhhqmp6ch9jjnv0qsquu7ftnq; expires=Sat, 10 May 2025 12:50:55 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w2A9kobhVPrCg6Qu1FbMSMr800PTIp6k9d04iHhdbV%2BMpMBVUcyc0g8wgka8iKPlVCXr79s3J7zQXYeAaJovyIIPeYVKHeGEZ%2BqORBB440WpvcTt2VUmPeqooueMcjvfcbYq16o%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe40c7a166370-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=49281&min_rtt=47030&rtt_var=13585&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2865&recv_bytes=586&delivery_rate=71120&cwnd=253&unsent_bytes=0&cid=b40e7f909293b487&ts=366&x=0"
DNS

pain-temper.bond

cmd.exe

Remote address:

8.8.8.8:53

Request

pain-temper.bond

IN A

Response

pain-temper.bond

IN A

104.21.73.40

pain-temper.bond

IN A

172.67.140.28
POST

https://pain-temper.bond/api

cmd.exe

Remote address:

104.21.73.40:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: pain-temper.bond

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:16 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=kvg9726hr7eduvi5ii93fbhc66; expires=Sat, 10 May 2025 12:50:55 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tgvaO3ElHN299Z23%2Bm%2Fs%2FvGMaja9zPwCOV9lFhSo9vyFUyQHOawdknwwUzK7M8B0pUvgZxgAv65VO3LVM%2Be2uTZ%2F7ns%2FmOw5yNDD5z2oA7rccsgWfS2KN8UcSSce2OP3m3UZ"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe40fce529439-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=49501&min_rtt=47727&rtt_var=12817&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2856&recv_bytes=584&delivery_rate=75089&cwnd=237&unsent_bytes=0&cid=c92ee9554e9291c2&ts=311&x=0"
DNS

jarry-fixxer.bond

cmd.exe

Remote address:

8.8.8.8:53

Request

jarry-fixxer.bond

IN A

Response

jarry-fixxer.bond

IN A

172.67.214.67

jarry-fixxer.bond

IN A

104.21.78.5
POST

https://jarry-fixxer.bond/api

cmd.exe

Remote address:

172.67.214.67:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: jarry-fixxer.bond

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=urii668i0octuaqtlatirca3vb; expires=Sat, 10 May 2025 12:50:56 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Mxj8nAAyT9p4YFUQwZOyk3r2CzOO99sch4zw1CcCTYKNFbOw3Wu5brSTZSQIGitoSZHbzM2q4uXZtYCFynD28jXZfbrqGum02mL4kEeOxDhIoaebv5AsL4De1IhcNe4ReS2Wg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe412aa79ede7-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=48638&min_rtt=46735&rtt_var=13198&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2860&recv_bytes=585&delivery_rate=76223&cwnd=249&unsent_bytes=0&cid=deafbf38c872975f&ts=281&x=0"
DNS

steamcommunity.com

cmd.exe

Remote address:

8.8.8.8:53

Request

steamcommunity.com

IN A

Response

steamcommunity.com

IN A

23.214.143.155
GET

https://steamcommunity.com/profiles/76561199724331900

cmd.exe

Remote address:

23.214.143.155:443

Request

GET /profiles/76561199724331900 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: steamcommunity.com

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Tue, 14 Jan 2025 19:04:18 GMT
Content-Length: 35608
Connection: keep-alive
Set-Cookie: sessionid=aded8e59f360b50bc0e16f2b; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
DNS

aleksandr-block.com

cmd.exe

Remote address:

8.8.8.8:53

Request

aleksandr-block.com

IN A

Response

aleksandr-block.com

IN A

172.67.164.157

aleksandr-block.com

IN A

104.21.81.211
POST

https://aleksandr-block.com/api

cmd.exe

Remote address:

172.67.164.157:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: aleksandr-block.com

Response

HTTP/1.1 200 OK

Date: Tue, 14 Jan 2025 19:04:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=cuoc6rmnlo723c6994t3hiapji; expires=Sat, 10 May 2025 12:50:57 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mOkaWL0mP2JGqnm1GEUOcIwgXQ8pjF2Sgqoq4EBn76N307eB%2FKMw71fpbQetP%2FB5EzFoKT%2FD9rAvbo0LoyCnu9AtCftoZUdc3pKv1LfpD7e81k2v7MFyfnhTK2ewEccFhrmbdyw4"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 901fe41bad3fbf0f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=51372&min_rtt=47304&rtt_var=14326&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2863&recv_bytes=587&delivery_rate=76022&cwnd=253&unsent_bytes=0&cid=8e7dad6a1b095561&ts=339&x=0"

172.67.186.121:443

https://handlequarte.shop/api

tls, http

cmd.exe

981 B
4.5kB
9
9

HTTP Request

POST https://handlequarte.shop/api

HTTP Response

200
104.21.49.103:443

https://strivehelpeu.bond/api

tls, http

cmd.exe

981 B
4.5kB
9
9

HTTP Request

POST https://strivehelpeu.bond/api

HTTP Response

200
104.21.96.1:443

https://crookedfoshe.bond/api

tls, http

cmd.exe

981 B
4.5kB
9
9

HTTP Request

POST https://crookedfoshe.bond/api

HTTP Response

200
104.21.32.87:443

https://immolatechallen.bond/api

tls, http

cmd.exe

984 B
4.5kB
9
9

HTTP Request

POST https://immolatechallen.bond/api

HTTP Response

200
104.21.55.3:443

https://stripedre-lot.bond/api

tls, http

cmd.exe

982 B
4.5kB
9
9

HTTP Request

POST https://stripedre-lot.bond/api

HTTP Response

200
104.21.48.1:443

https://growthselec.bond/api

tls, http

cmd.exe

980 B
4.4kB
9
9

HTTP Request

POST https://growthselec.bond/api

HTTP Response

200
104.21.40.131:443

https://jarry-deatile.bond/api

tls, http

cmd.exe

982 B
4.4kB
9
9

HTTP Request

POST https://jarry-deatile.bond/api

HTTP Response

200
104.21.73.40:443

https://pain-temper.bond/api

tls, http

cmd.exe

980 B
4.5kB
9
9

HTTP Request

POST https://pain-temper.bond/api

HTTP Response

200
172.67.214.67:443

https://jarry-fixxer.bond/api

tls, http

cmd.exe

981 B
4.4kB
9
9

HTTP Request

POST https://jarry-fixxer.bond/api

HTTP Response

200
23.214.143.155:443

https://steamcommunity.com/profiles/76561199724331900

tls, http

cmd.exe

1.6kB
43.0kB
24
37

HTTP Request

GET https://steamcommunity.com/profiles/76561199724331900

HTTP Response

200
172.67.164.157:443

https://aleksandr-block.com/api

tls, http

cmd.exe

983 B
4.4kB
9
9

HTTP Request

POST https://aleksandr-block.com/api

HTTP Response

200

8.8.8.8:53

handlequarte.shop

dns

cmd.exe

63 B
95 B
1
1

DNS Request

handlequarte.shop

DNS Response

172.67.186.121

104.21.19.140
8.8.8.8:53

strivehelpeu.bond

dns

cmd.exe

63 B
95 B
1
1

DNS Request

strivehelpeu.bond

DNS Response

104.21.49.103

172.67.161.160
8.8.8.8:53

crookedfoshe.bond

dns

cmd.exe

63 B
175 B
1
1

DNS Request

crookedfoshe.bond

DNS Response

104.21.96.1

104.21.112.1

104.21.48.1

104.21.64.1

104.21.32.1

104.21.80.1

104.21.16.1
8.8.8.8:53

immolatechallen.bond

dns

cmd.exe

66 B
98 B
1
1

DNS Request

immolatechallen.bond

DNS Response

104.21.32.87

172.67.185.74
8.8.8.8:53

stripedre-lot.bond

dns

cmd.exe

64 B
96 B
1
1

DNS Request

stripedre-lot.bond

DNS Response

104.21.55.3

172.67.143.194
8.8.8.8:53

growthselec.bond

dns

cmd.exe

62 B
174 B
1
1

DNS Request

growthselec.bond

DNS Response

104.21.48.1

104.21.96.1

104.21.32.1

104.21.80.1

104.21.112.1

104.21.64.1

104.21.16.1
8.8.8.8:53

jarry-deatile.bond

dns

cmd.exe

64 B
96 B
1
1

DNS Request

jarry-deatile.bond

DNS Response

104.21.40.131

172.67.151.242
8.8.8.8:53

pain-temper.bond

dns

cmd.exe

62 B
94 B
1
1

DNS Request

pain-temper.bond

DNS Response

104.21.73.40

172.67.140.28
8.8.8.8:53

jarry-fixxer.bond

dns

cmd.exe

63 B
95 B
1
1

DNS Request

jarry-fixxer.bond

DNS Response

172.67.214.67

104.21.78.5
8.8.8.8:53

steamcommunity.com

dns

cmd.exe

64 B
80 B
1
1

DNS Request

steamcommunity.com

DNS Response

23.214.143.155
8.8.8.8:53

aleksandr-block.com

dns

cmd.exe

65 B
97 B
1
1

DNS Request

aleksandr-block.com

DNS Response

172.67.164.157

104.21.81.211

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76d55b.rbs

Filesize
8KB

MD5
10a9a28a53c5dbd25f8a6909b4886d44

SHA1
8cc94fbeccdeff4e128ab2f25105747a53a2d00c

SHA256
5d56428da2f643e751e20f509783c82f811abbf64c7160d00554e941c280001c

SHA512
319820a3c0eb7a69f03c9876e9c18650ef9dea0b3322461ac0e61a6677717380d87678edbb3caac1ab9aeb26e81630d2f08c7fad04f0baa1b41fa403f430ff15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Arrivisme\archiepiscopacy.yaml

Filesize
815KB

MD5
47d369b338e13d5e243544b3c5425d7a

SHA1
2ab78d40a4c4982175aea3c2d1bd0332ceb8c241

SHA256
21d3db6c03ddf05e5eec27b047e33de15b0164d79d35acbc0527b44d71515147

SHA512
af992af7479139dc5e60f08b3df6fbc6d42e319b446db5352a1fcb6f5334acafb9681f85d75a4f9070fe6b4fcd9530784433934daffe26ea6b137cef96013ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Arrivisme\bobble.txt

Filesize
44KB

MD5
85190373e9b50a5908774e73c2071f78

SHA1
385f1def7007914c5a7a1d9c0354e326af4540cc

SHA256
56e1e2e1ce9c132f17ff26edcf79da628da2ea94b1e470cadebf23f140f0a3c0

SHA512
fd240d3d1b49abb10e26906a7c27b5eda969745cd8f311a9c1f9c914a58a290498f5e01af96dc662fd666fa388bd7be95827a61c190f5b07c020f0b04bdc0996

Download Submit
C:\Users\Admin\AppData\Local\Temp\Arrivisme\tier0_s64.dll

Filesize
394KB

MD5
f0be921a6ec41e5622da1b5fc1cefedf

SHA1
ffbb7f95015a16731cc0a89ccce844a35cdd0f2e

SHA256
366f2728eee842fa56dc03e848199642cdc0eda0b2e156fe941b056e8b5a2b73

SHA512
54afd7c740ff21a527c70922b94d8176eff7d8a9cce702091df0f7f0d168dc09db0a6e11d3985e3342959676d8209acd7600eb7bdb7007baa9044831f149070c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3d70052

Filesize
1.0MB

MD5
9e7610c0543c41dacb1808d5c6bf721c

SHA1
3fb1a6790ed1f4a972696fc2258d37e1534a41a3

SHA256
0330c67dd68cb247b19df4c4db7364d3d6c2865196a3533f2871a2cabf2341e5

SHA512
d601d217f7a73a7889b2bb782f05f3e1196d6894183878133258eec1c11b664ef154afef9e5c9afa15fa310e2d9d61a1fc1e959671a7119cbc67061233646751

Download Submit
C:\Windows\Installer\f76d559.msi

Filesize
1.3MB

MD5
0cd2b95df897bd2037edff092699e169

SHA1
18c5d3394d9260c2641e06a58847b7a2818b8174

SHA256
3e50b308a6366677b3fed9579f8f13dc721ae30b1534591c0ce5e083c1923a9f

SHA512
b3015d2beb30d841f0fc1a46baf7b56664c23e10538b519b791d9cc9fc86602811d52eb328c3d7e0832d5dece0019e01985e0e97a63037217574e475f93c95b1

Download Submit
\Users\Admin\AppData\Local\Temp\Arrivisme\steamerrorreporter64.exe

Filesize
641KB

MD5
d21dbb34dfab75a0bd4b6d097d716f06

SHA1
fd298b1a939fc87f989ca0809fe5b3f284b7fe19

SHA256
c8ee8c33a35fbb2eb7aac8bb4eb31c94a8cc3fab11aa5580391667c21f5ead3f

SHA512
515ba560964d0b68c46b4b6a285c29e4acf79842ebf632127900cafcd59248a55a93515937600be29490e5677323632f73dd91e2830e95ab1dd6ed71477397e4

Download Submit
\Users\Admin\AppData\Local\Temp\Arrivisme\vstdlib_s64.dll

Filesize
681KB

MD5
a395dbffcd50ce79c74c67944ec9a022

SHA1
f757fc586be9d450fda9b3a7fcc57e935c1905ba

SHA256
516dfce788eca1dac99fdbf3783ad3d59a5e3dbd97d611bcea41b1c4a3cda005

SHA512
c7e01d56509d0e2df41942e516ea4c95cbbb0fa677ce8a95c3a05a027eb1b625f6206b408570ed27cff0e42dad29b061132133429adb514c864acad61cb01762

Download Submit
memory/1972-34-0x000007FEF6810000-0x000007FEF6968000-memory.dmp

Filesize
1.3MB

Download
memory/2664-50-0x000007FEF5FC0000-0x000007FEF6118000-memory.dmp

Filesize
1.3MB

Download
memory/2664-51-0x000007FEF5FC0000-0x000007FEF6118000-memory.dmp

Filesize
1.3MB

Download
memory/3064-54-0x0000000077740000-0x00000000778E9000-memory.dmp

Filesize
1.7MB

Download
memory/3064-55-0x0000000072D70000-0x0000000073DD2000-memory.dmp

Filesize
16.4MB

Download
memory/3064-58-0x0000000074E90000-0x0000000075004000-memory.dmp

Filesize
1.5MB

Download
memory/3064-59-0x0000000072D70000-0x0000000073DD2000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.