lumma | hxxps://darknessonyx[.]com/ryos

Analysis

max time kernel
124s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://darknessonyx.com/ryos

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://uprootquincju.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3936	msedge.exe
3936	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
4524	msedge.exe
4524	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4400	3936	msedge.exe	84
PID 3936 wrote to memory of 4400	3936	msedge.exe	84
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3940	3936	msedge.exe	85
PID 3936 wrote to memory of 3348	3936	msedge.exe	86
PID 3936 wrote to memory of 3348	3936	msedge.exe	86
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87
PID 3936 wrote to memory of 1676	3936	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://darknessonyx.com/ryos
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9de8c46f8,0x7ff9de8c4708,0x7ff9de8c4718
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,16026125251807245359,9812381071252891869,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1460

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_8WL@O7_XlRY.zip\README.txt
1⤵
PID:316

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2764

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2196

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4956

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4860

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3552

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1440

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\8WL@O7_XlRY\README.txt
1⤵
PID:3284

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3904

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5064

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5104

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2376

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2cb452aa-7eab-46c8-8382-e72e19279b9a.tmp

Filesize
10KB

MD5
69c34f2fccc35672226d96891df75b00

SHA1
3ff6796937ea2cc0e453b65b584442755b6521f6

SHA256
3dc8d86225bab70e20c56d66438d34c26ce19fcd083f22418a9e04e5d8720d09

SHA512
724ac57cf64207dd9834c2710460daa2b7883644c7bc5eb88670ae3c9f4c18dec3070bfa60d9c786cc0ed5b714e6dda7ab1ab091f0b01565c833789387a0f327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
4fa3a2c51d0dc77756aebf24643d883a

SHA1
bc15b2b16abe5a8efd01782f84f7fb0884c37874

SHA256
151e21b71255ce2869afc1fa7e62962250a85252a59d2c52df900ca4f923307a

SHA512
dfabfc275f79d7fed3b8880da0bc036c10334813ef43ede4633ac1862acda8555529d0ea74457b48e609706c10abb65740085a888080571f379e93a07e900dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
45ca63792c409bc99cc41d1ba32cfe82

SHA1
91e9711d54bb8ae2afbd203b3aaadd312a974e08

SHA256
83abfa21820e87215fe840f9d8c659eb5bb75326164077d9f2b2e9c3dbfb2cbe

SHA512
051b50dc9d35fb1e0fb3bd30f1a68d764796852175032b0f62b0183476a6ee08b36217a208ae95f6bfe97b0c8f595b3295a6db2e3e772f9056e975f188d52dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
789102007e63bdbbb98a8a8f1129ffaf

SHA1
9f4c4360751702a2c7305dff76795aebb9bf8516

SHA256
05b12805ae549e9d4e9d441b70ba1785af7f35973a537f94cd1fd4cc80186ab4

SHA512
1a188de5ee4abeb91435654297b4ca3c5b9a49a6dad40765026e7b52fdf7127efb9c5fc02eaadab5cd64045d781752c12aabdf7bfd9b1b15b47939cde4ca3785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bbe4c3d074531fe0665220e423f76c0d

SHA1
181164b73a7242d697dff77d72551b61895c66d5

SHA256
14378f76dfd0fd4a1d4eb36e7a8e0e14758a6d397eab0c34de8d8bb246436bd3

SHA512
34f901aa20ee7392d841fe17ed1588f14b1ba7042c7790c037720e39b88eb621ab108095781aba5f78cbe4bb7b99ed8366c3ebbfd7e843c49128b251faadddcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f478d022776a166aff667b7d5ef4e463

SHA1
1cbea95b7f9f6dce794f6f818baed67eee6e4ee7

SHA256
8f3ac6452840343ab03a85ce6d24dec12562c108d683127b81318c8af70958e1

SHA512
c1fa1c1cdb95a1de6541e4d298d595ddaa5aea00a9428b81f5904c942794090c003e4fa1c7c4c565435048afb1b68bfdbdbb3514dfd60d51f60447f25ea3ffe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9931376e06cb24cb706155232df6b938

SHA1
8398e52c190c564ad5269f6ef37257a62293f880

SHA256
e775afa4643c0b2c5328c087bc8ab187b0be4d1d0def75a8f4431598de6a09cc

SHA512
760891c77e08f5944c879ba26a967bf2ad0b2ccfddfcb29d5d9ad5d5f36a82aa86a1ba9c738e3f3ce7789064a584139f8f210d3e1b3d3231e7874dae317df747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ded6896d9e441f9d39a72030580911cd

SHA1
aaa7fb30ff57d52783ee80f8a99f6bbd02d9ba6b

SHA256
38676488eecd1dd9ec1e72b472f95d04c47f1579d9d4e3ec224b56c76c717f08

SHA512
c67ac7003ab9ef592d813592c83ea431801acc9fa787591c891fc6a3e545c49db593b5a8d74e8e23183ba93d8c39428c7621907bde49076630e6c3b0823ff381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98a577500a718fed4e8fdf257e5fbaf9

SHA1
179264b69bac8752eaca905c30be8bddc8f76507

SHA256
ba0d9724f50f13f5ef875610844a1c3ebc036f054104f46ba0bdec412200032d

SHA512
1a782279b650b494103fadfc213786e4790d831a0425e28b1761602635b849e35e3c5d9cb7ac0f97ac1984b1feda1fdaae881a09855d1ca66a694de8d7f85a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5543e8b313c6b28cac6e162150be6165

SHA1
5c197f46ef3b3c3ad2b9af5eebd84287392fe4b8

SHA256
550083d3506219058796ec7c200b2587f9d8bd0794efeb9f1d42ffa57eb4820b

SHA512
aab72030ef6203aa1b3534bb38d23c2aa5aeeea8a75488f6db1633e35f2b4c4466f70bfe44414d1395c0efa8328635f90ad9086100f3d16947af67616176ed71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c95b.TMP

Filesize
539B

MD5
32c564a060ed0c74640b304b99744bc1

SHA1
94edc7ebfc6337e61591e822273d770f092a9074

SHA256
cf3125b2d24e60c59894348b91fa702655b8f0ec2dce3d8932d96e6539db86b1

SHA512
273ca3dc07a717b71280cf985ce47087a932bd60f89ceaf7dbfa22c259ba4a0b3106248e960d4f48192bc02363a7992424e0666f6946455ee90c186fdf248344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
669a8f14a3ef46d8db72b136933ce63b

SHA1
3d0f9cc7953889be4d159bcd5fceda80ec03c2f5

SHA256
8d0c81f51a9e98292fbdd67d32f6ef1a6b77ccbc61d3b917a554a507f61790ce

SHA512
7a20bf0693889dde1ec92b0d1aaf5d6fe35a624b7c01f78b6357f4e02403a2d5b427d14154e0cc4fbd25f0df6b8ac7af77dd02d3b810e9a40cfefc8a2adae495

Download Submit
C:\Users\Admin\Downloads\8WL@O7_XlRY.zip

Filesize
1.3MB

MD5
f2a2deb66220dec15632f27d91bbdb16

SHA1
8edd492215d95f2df5088a2626fb87664697790a

SHA256
de94a3e312de49229cfd088163fb38610b286c7399eb5dc15410e46a25fafb2e

SHA512
ee611e2b151627adb6ce2caa5a29091a0d8e202099de56fa99fdea022a3ca03b26b5da2747a340198f81d12f57a00b58e5c7169d1ee29a38fd84e4a51fc51fd5

Download Submit
memory/1440-338-0x00000000034A0000-0x00000000034F8000-memory.dmp

Filesize
352KB

Download
memory/1440-339-0x00000000034A0000-0x00000000034F8000-memory.dmp

Filesize
352KB

Download
memory/1440-340-0x00000000034A0000-0x00000000034F8000-memory.dmp

Filesize
352KB

Download
memory/1440-342-0x00000000034A0000-0x00000000034F8000-memory.dmp

Filesize
352KB

Download
memory/1440-341-0x00000000034A0000-0x00000000034F8000-memory.dmp

Filesize
352KB

Download
memory/1440-314-0x0000000000CF0000-0x0000000000F22000-memory.dmp

Filesize
2.2MB

Download
memory/1440-337-0x00000000033A0000-0x0000000003498000-memory.dmp

Filesize
992KB

Download
memory/2196-324-0x0000000000CF0000-0x0000000000F22000-memory.dmp

Filesize
2.2MB

Download
memory/2196-294-0x0000000002F80000-0x0000000002FD8000-memory.dmp

Filesize
352KB

Download
memory/2196-293-0x0000000002F80000-0x0000000002FD8000-memory.dmp

Filesize
352KB

Download
memory/2196-289-0x0000000000CF0000-0x0000000000F22000-memory.dmp

Filesize
2.2MB

Download
memory/2196-292-0x0000000002E80000-0x0000000002F78000-memory.dmp

Filesize
992KB

Download
memory/2196-297-0x0000000002F80000-0x0000000002FD8000-memory.dmp

Filesize
352KB

Download
memory/2196-298-0x0000000002E80000-0x0000000002F78000-memory.dmp

Filesize
992KB

Download
memory/2196-296-0x0000000002F80000-0x0000000002FD8000-memory.dmp

Filesize
352KB

Download
memory/2196-295-0x0000000002F80000-0x0000000002FD8000-memory.dmp

Filesize
352KB

Download
memory/2764-279-0x0000000000F30000-0x0000000001029000-memory.dmp

Filesize
996KB

Download
memory/2764-282-0x0000000000C60000-0x0000000000CB8000-memory.dmp

Filesize
352KB

Download
memory/2764-281-0x0000000003020000-0x0000000003118000-memory.dmp

Filesize
992KB

Download
memory/2764-302-0x0000000000CF0000-0x0000000000F22000-memory.dmp

Filesize
2.2MB

Download
memory/2764-280-0x0000000003020000-0x0000000003118000-memory.dmp

Filesize
992KB

Download
memory/2764-288-0x0000000000CF0000-0x0000000000F22000-memory.dmp

Filesize
2.2MB

Download
memory/2764-283-0x0000000000C60000-0x0000000000CB8000-memory.dmp

Filesize
352KB

Download
memory/2764-287-0x0000000003020000-0x0000000003118000-memory.dmp

Filesize
992KB

Download
memory/2764-286-0x0000000000C60000-0x0000000000CB8000-memory.dmp

Filesize
352KB

Download
memory/2764-285-0x0000000000C60000-0x0000000000CB8000-memory.dmp

Filesize
352KB

Download
memory/2764-284-0x0000000000C60000-0x0000000000CB8000-memory.dmp

Filesize
352KB

Download
memory/3552-332-0x0000000000AC0000-0x0000000000B18000-memory.dmp

Filesize
352KB

Download
memory/3552-333-0x0000000002B90000-0x0000000002C88000-memory.dmp

Filesize
992KB

Download
memory/3552-331-0x0000000000AC0000-0x0000000000B18000-memory.dmp

Filesize
352KB

Download
memory/3552-330-0x0000000000AC0000-0x0000000000B18000-memory.dmp

Filesize
352KB

Download
memory/3552-327-0x0000000002B90000-0x0000000002C88000-memory.dmp

Filesize
992KB

Download
memory/3552-328-0x0000000000AC0000-0x0000000000B18000-memory.dmp

Filesize
352KB

Download
memory/3552-304-0x0000000000CF0000-0x0000000000F22000-memory.dmp

Filesize
2.2MB

Download
memory/3552-329-0x0000000000AC0000-0x0000000000B18000-memory.dmp

Filesize
352KB

Download
memory/4860-321-0x0000000001670000-0x00000000016C8000-memory.dmp

Filesize
352KB

Download
memory/4860-318-0x0000000001670000-0x00000000016C8000-memory.dmp

Filesize
352KB

Download
memory/4860-319-0x0000000001670000-0x00000000016C8000-memory.dmp

Filesize
352KB

Download
memory/4860-320-0x0000000001670000-0x00000000016C8000-memory.dmp

Filesize
352KB

Download
memory/4860-322-0x0000000001670000-0x00000000016C8000-memory.dmp

Filesize
352KB

Download
memory/4860-323-0x0000000003350000-0x0000000003448000-memory.dmp

Filesize
992KB

Download
memory/4860-317-0x0000000003350000-0x0000000003448000-memory.dmp

Filesize
992KB

Download
memory/4860-303-0x0000000000CF0000-0x0000000000F22000-memory.dmp

Filesize
2.2MB

Download
memory/4956-312-0x0000000000F70000-0x0000000000FC8000-memory.dmp

Filesize
352KB

Download
memory/4956-309-0x0000000000F70000-0x0000000000FC8000-memory.dmp

Filesize
352KB

Download
memory/4956-334-0x0000000000CF0000-0x0000000000F22000-memory.dmp

Filesize
2.2MB

Download
memory/4956-313-0x0000000003600000-0x00000000036F8000-memory.dmp

Filesize
992KB

Download
memory/4956-310-0x0000000000F70000-0x0000000000FC8000-memory.dmp

Filesize
352KB

Download
memory/4956-311-0x0000000000F70000-0x0000000000FC8000-memory.dmp

Filesize
352KB

Download
memory/4956-307-0x0000000003600000-0x00000000036F8000-memory.dmp

Filesize
992KB

Download
memory/4956-308-0x0000000000F70000-0x0000000000FC8000-memory.dmp

Filesize
352KB

Download
memory/4956-300-0x0000000000CF0000-0x0000000000F22000-memory.dmp

Filesize
2.2MB

Download