njrat | hxxps://www[.]mediafire[.]com/file/zsem6n4waptn6ib/Lammer2[.]exe/file

Analysis

user interaction
yes
max time kernel
900s
max time network
894s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/02/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/zsem6n4waptn6ib/Lammer2.exe/file
Sample260216-b3fhfaht6d

Score

10^/10

lammer2 defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer2

zebuceta.ddns.net:1177

Mutex

6b4f0639358aec19ec006fbaa75355bb

Attributes

reg_key
6b4f0639358aec19ec006fbaa75355bb
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
78	4248	chrome.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4204	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	Lammer2.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b4f0639358aec19ec006fbaa75355bb.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b4f0639358aec19ec006fbaa75355bb.exe	Trojan.exe

Executes dropped EXE 3 IoCs

pid	Process
1728	Lammer2.exe
1156	Trojan.exe
2408	Trojan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6b4f0639358aec19ec006fbaa75355bb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6b4f0639358aec19ec006fbaa75355bb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lammer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4248	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134156796091291220"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
4424	chrome.exe
4424	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1156	Trojan.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeDebugPrivilege	1156	Trojan.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1532	1276	chrome.exe	88
PID 1276 wrote to memory of 2968	1276	chrome.exe	89
PID 1276 wrote to memory of 2968	1276	chrome.exe	89
PID 1276 wrote to memory of 4248	1276	chrome.exe	90
PID 1276 wrote to memory of 2700	1276	chrome.exe	91
PID 1276 wrote to memory of 2700	1276	chrome.exe	91
PID 1276 wrote to memory of 4184	1276	chrome.exe	95
PID 1276 wrote to memory of 1068	1276	chrome.exe	96
PID 1276 wrote to memory of 4184	1276	chrome.exe	95
PID 1276 wrote to memory of 1068	1276	chrome.exe	96
PID 1276 wrote to memory of 3564	1276	chrome.exe	97
PID 1276 wrote to memory of 3564	1276	chrome.exe	97
PID 1276 wrote to memory of 4152	1276	chrome.exe	98
PID 1276 wrote to memory of 4152	1276	chrome.exe	98
PID 1276 wrote to memory of 4108	1276	chrome.exe	106
PID 1276 wrote to memory of 4108	1276	chrome.exe	111
PID 1728 wrote to memory of 1156	1728	Lammer2.exe	117
PID 1156 wrote to memory of 4204	1156	Trojan.exe	118
PID 1276 wrote to memory of 2160	1276	chrome.exe	122
PID 1276 wrote to memory of 4368	1276	chrome.exe	123
PID 1276 wrote to memory of 4596	1276	chrome.exe	124
PID 1276 wrote to memory of 4424	1276	chrome.exe	134
PID 1276 wrote to memory of 1960	1276	chrome.exe	135
PID 1276 wrote to memory of 1960	1276	chrome.exe	135

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/zsem6n4waptn6ib/Lammer2.exe/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7e8bc728,0x7ffe7e8bc734,0x7ffe7e8bc740
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,9175626705136565939,8563894414390421528,262144 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1552,i,3339751185847712722,9033382646961695262,524288 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,1320287699959070111,3694543705959567499,524288 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,10762726156814261640,1832454645450749990,2097152 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,14423671140605652695,15042052991109998628,2097152 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,18072385600836110748,5194928233396355736,2097152 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5212,i,3858727625401342883,10818996148870054915,2097152 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,2072172726746563220,8064218270537380281,524288 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,5557532805075255052,10832095739210052611,524288 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,6187950583156167065,8745871109476928612,524288 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,9753226866833518597,2243472313911648621,524288 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,11125092560359982450,16817150382541536099,524288 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4328,i,4513223154206475268,12511993339204588987,262144 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,11195537714107163799,9515256476358018931,524288 --field-trial-handle=2020,i,12887768989129712267,320532473799726815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2272

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1808

C:\Users\Admin\Downloads\Lammer2.exe
"C:\Users\Admin\Downloads\Lammer2.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\Trojan.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4204

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.exe" ..
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 cee0a7a6a964c25a9cf41d81a9ced9ff5fc210303cad1ae573f7e22538136191
MD5 3ca39913f806602f5df87cc754f33c1d
SHA1 1efeeb2f4ae0b4050d16787bb6d37c7f657271ab
SHA512 454f0a02cf659420e75e3afcbb8137443d64612480984a84f25a7e2c9a34a7215ad2b274f0404ee8199dc8aeede8bb38b29c029ec7a33e7ce81dd6d97f2cbcdc
TLSH
T10DF07DA5C925AC371AFD1B1D20945B4AEB40035B2741484F3A3C820C8FB013B864581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 137194350c61f708f394b88b9ae2e9d3bb0b79f2d143fe68a16d312eb26fe178
MD5 dd3702dc7931124a8be3842f4834302e
SHA1 da8eb39e2b16f2a003eda65f13699b36e5aea8f3
SHA512 9fbf34e128b9f36bae8a514f9b8581c7ce6a5ea6ca3e6723e21e8bb69bf2b0b8a768e067e3ff506a9d80aeb22c163a4ac21e65066c0adb97b7b442c4d09f2f97
TLSH
T10BF0D897B197B403CF941DB6605EEF5318708633457D63BE808461F155136F844C7E98
MD5 SHA1 SHA512 TLSH

Submit Download

7d2db747-20ab-4181-b772-a1d6dbb9ea50.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7d2db747-20ab-4181-b772-a1d6dbb9ea50.tmp
Size 7KB
SHA256 1dbd0d268ee021d9985d955e8b965a94b1eb1191a85e15082f06ce15aa720f24
MD5 1d2d1dfa195f3fec667ff0a58b3dc1a8
SHA1 a595945ef3683e78dd905b10f580d270445aef72
SHA512 ee1aedbe8747f49874d0a72c675fd2353c76c1fd2cc12b6e42a7e7449fb860b49a5a6e44f76a5c09266e6c1a0d86be2750ae290b92ca15f6ad26332aacc11a76
SSDEEP 192:DurJlbUW8FgdnJpe3n4IYKjAv4VCAAzTYYJOEqeQt:DurJNUW8FgdnJpe3n4IYKjAv4VCAAzTQ
TLSH
T135F1CCF3D3E8D92E890156F8A6146E1BCE6C0B19532C3C5AC8D4EE4BA3E2472D25954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e6f8fa2c23d629f21c537d5735602b829722d6b9addebfe71cfa1b12b63175fd
MD5 ad27cb9d44a765ea8a4f05b8a97344e7
SHA1 c34242533c53216902da1b1d3c46ba293174c4c7
SHA512 ba06d2d774c168b0228d069ad4449700ec33d858aafeae84a3f2629a912bd0e909efab649a3187889c850e372a2f2182b6585864e605ab743dd30bb0fa9c530b
SSDEEP 192:DuWYDbUW8FgdnJpe3n4IYKkAv4VCAAa3YYJOEqeq7vjhCWd:DuWY/UW8FgdnJpe3n4IYKkAv4VCAAa3c
TLSH
T12D02CCF3C3E8D96E890156F8A6146E1BCE6C0B15532C3C6AC8D4EE4BE3E2472D25954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 4f8d2db4436a591496b780216552063438a8e7869d9801e40f641949c81c73f9
MD5 8ab8eb2b426549faca46cd630091059e
SHA1 2cba10f603285b57428fdb5e338e1f4f42598b9e
SHA512 d7dbd38299ddcfd8892a8f9a7e408a53bc5591e48b31dba68701a9d5b64563136b1dcad6e723bbbbd9de499e720ce79a878bc13d69c037c19a7e2a7f96bcce84
TLSH
T1EF2161A7B2BEB85B302C48B72D04B8466A7B783111D154F4CFA6416CB0C6CF75B02427
MD5 SHA1 SHA512 TLSH

Submit Download

f8d8750d-2965-465a-942d-62f1457a4071.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f8d8750d-2965-465a-942d-62f1457a4071.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d95c20e1fb9dca25921ed5675f4b139b99317c17e7c68782c273d58d8c51cf7f
MD5 147ed0dacd8ee3ac72f339098d3fe9c6
SHA1 ee4f2725b67b7167ee56a4778b093359c6003807
SHA512 548f2bd2ba1d649f91a5d0fdbfa373e1316a33058ee2f510601babdc17ae21edf904b82b577b25de956d7e465680c9d9d68d0e9284a8d3c0cac46aae422d95ba
SSDEEP 192:WRWrgXOSbhWv7rpAPRp2Ru9+Hsb+WNnjp8oHH2YNeg8vVyIsnAUge:WRWr4ofUXHEwWo25e
TLSH
T12C42E81DAA187A7B9DDBC11EF9657B57DBF6102170801D48EAFCCA2C11E79CD621302B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c3448674a1968416db39e07c1f1bf2eae43b16f54972e1225626a85ddbd5720a
MD5 407198b52605b107076ad72acfc445f0
SHA1 688ff46a7b7124d9caede4654aa56e014d5ec641
SHA512 5b42900f2d68efe8cadbb908edd1090cae88b63e190b20f846e2fa9ed4a9447c7fe7ece4a99fb8dd11f2e821fdd4cddaf70effbecd9bd5d9d2f054fb8c27af2e
SSDEEP 192:WRWrgXOSbPv7rp9PRphRu9+Hsb+WNnjp8oc4emNeg8PVyIsnAUgE:WRWr4Hf/XKEwWYebE
TLSH
T17352E81DAA187A7B9DDBD11EF9617B57EBF5102170801E48E6FCCA2C11E79CD221302B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f742953482c752a4278a9309e3aa5dbb5050f826fa905e86abe5156ef5dd0614
MD5 57e44f843db393dbe8e7dc5ffc23da7a
SHA1 6a29ae9810310b167ac0a4cb6a07aac26e364ec0
SHA512 62886721e6a97fbb35edc5250c2addb46d77dce4b41154997c0e075c583fe66ee3cf139237fa4def6d9ee779665cf9a3959d5bf51e0093d37f3006247646ec8e
SSDEEP 192:WRWr1JXOSbPv7rp9PRphRu9+Hsb+WNnjp8oc4emNeg8PVyIsnAUgE:WRWrlHf/XKEwWYebE
TLSH
T10652F81DAA187A7B9DDBC11EF9617B57EBF1102170801E48E6FCCA2C21E79CD621306B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c7695e6fb55bbde3d36fa929809e408c144ee16bd6d9c96f5f76913822bc6857
MD5 554b9142e64990418bb0e2d2296dc1fb
SHA1 9875162ce34c87eb9167590471774a5d76d45b21
SHA512 a958639d53524019b175e84b62cb4228dfd6ec9015a041e03b5fbb6bc188a1c72b5c390b4ba81baae4f02c22a01491342e9150643cd75d4277ea314d2ecec058
TLSH
T1F4B0126580015511C00302F511835C887214AF108719130153E069B59C262B18424190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a9e7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a9e7.TMP
Size 96B
SHA256 43e52eab5eb112564ea22ef7d803ef0083c6bf71d7a8122a28b7188a4d897ea4
MD5 fa1b9d2a1747678dc2a900eecafbe74c
SHA1 d3374868e0f8e43c2b77375013fe76a4883055fe
SHA512 99a31525c60de10955472297190ba58a455b08c4c2c44fc6bdb33f7f124675d9e66622c5e77012f9c31730b8fac0566d486b23ab2148e067538629160b25b3d1
TLSH
T1A7B0025BD5067313D04203B06D9999DA7174DF25C607221AA7E11A66EC2A6B48625660
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 da01a35190c50a28cd89b1f0d98873f930405ca791a24377f0e4936a2a8d91ca
MD5 f7133003466ae6d9bcbde43f70aa45d9
SHA1 6caa980f76d72b6076ae1e65a0e346e72f273ce3
SHA512 1851a6e06148960b2709fd61f388a3583726df25d07df2eaaff44adc47683acdee8f7a66ed3d8ea305267717824c2ebd8b8a8a42468cdc91ccbf7109bc37fbc2
SSDEEP 1536:yVlmcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YF:Ylm3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1169302B99E1A4AE799BE5A91325E7C09CD16230E305FB98C719C978C21D01CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 7b743cae55f9dcbcbf748e6af41360e853c37454ed4604bd50b597bd5895615d
MD5 6fb2200b92cbea62a894fbd1fc0f9ad4
SHA1 1d03ff865a903740d49aa2b5aab277252686409a
SHA512 cd4f964c70c5ff4158d846b22fd10e888b69c466e765de2634184439b9fb17fe2d2890ffbfe994fde5496aa0328a08646d1ed6ef424abcb747e56865ed112707
SSDEEP 1536:jV2cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:x23Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1839302BA5E174AE7957D4A9176AE7808CE16630D70AFA8CC315CA38C21D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e7c9abc9c2af8a519691bb26e85c2c22e029db06d3e206014984ce9cc44cd604
MD5 cae7f3abcc42cfd29a588beabda54dc2
SHA1 2bb26c9ac0dc0420ebd8378bd7731b06dfe01d6c
SHA512 164429c4ea9c93e837a9ea79cbf46ea0173d554e418632d90a15e9cfde648e94b40892cbabdb1be544c1d1d866f4ca80a40cbc3591b5c25f9df1fddf7c869e09
SSDEEP 1536:jVZcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xZ3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1FF9312BA9E1A56F7997D46D1729E780ACE26234D309FA98C719C538C21D01C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 eea0d08706a4ebfde4fb3bd2f1a037bd1950298e06e9117c05ba8712ca70f6a0
MD5 41cc3cb58edb2df9416e33b20855e15a
SHA1 3244895f982d1e7715efcdbe267d97a0f0401f5a
SHA512 a7b31270cc5ee7b3882b4c742c2481c093543bedc88f0f5e51703dfa5ece2e6727b769002ea2a0346adf04523357552e3277d75ea17a0a5ae068b7864a827e15
SSDEEP 1536:mVlmcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YF:slm3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1F99302B99E1A4AE799BE5A95329E7C09CD16230E305F788C719C978C21D01CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 0515c8b37b497451a9501083862ee268951fd49db4c94b76049709df153bbe58
MD5 b14c6d7d6541b74d39c935d30359882b
SHA1 821579c4503477d6d2fcf5d86400000f0eb1f63b
SHA512 1fbd8fab0a9b48f6957cfd6602ce796a3ebd3f46d14920299ee2ca527096b7f6064da97077e9b2ae58c95beaed280e935e7ed337606fcfb2a237d6ed51ed90d6
SSDEEP 1536:yVZcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:YZ3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1259312BA5E1A56F7997D56D1729E780ACE22230D309FA98C729C538C21D01C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lammer2.exe

Path C:\Users\Admin\Downloads\Lammer2.exe
Size 23KB
SHA256 ec87cf495fbbd5d88f1d2838b40c2ba9973b268cac6a588fde49a116c0138ad2
MD5 aa71c3a4547a8b459195514dedb77493
SHA1 3ccb18ddddd01f0654ce7a6f23a46c36198c4315
SHA512 0adf15f974884ecf8f12116964959ad22a2d89e85b576e6f9809951336d111106fe9292e015b152714862b9576378b43e5abf758c1375a6b608bf5135f433131
SSDEEP 384:6sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZra:Vf65K2Yf1jKRpcnuh
TLSH
T198B22C4E3FA98856C9BC17748AB5965003B4D1870423EE2FCCC554CBAFB3AD91D48AF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-170-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Download

memory/1156-162-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Download

memory/1728-136-0x0000000074EF2000-0x0000000074EF4000-memory.dmp

Download

memory/1728-135-0x0000000000B20000-0x0000000000B30000-memory.dmp

Download