njrat | hxxps://www[.]mediafire[.]com/file/eee6wy8iekaq0y1/Lammer1[.]exe/file

Analysis

user interaction
yes
max time kernel
899s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20260129-en
resource tags

arch:x64arch:x86image:win10v2004-20260129-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/02/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/eee6wy8iekaq0y1/Lammer1.exe/file
Sample260216-brbp4sg12e

Score

10^/10

lammer defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

170.245.122.76:1177

Mutex

1ab63eab1ed5ccd5c1889e531b858731

Attributes

reg_key
1ab63eab1ed5ccd5c1889e531b858731
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
137	824	chrome.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1492	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\Control Panel\International\Geo\Nation	Lammer1.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ab63eab1ed5ccd5c1889e531b858731.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ab63eab1ed5ccd5c1889e531b858731.exe	Trojan.exe

Executes dropped EXE 3 IoCs

pid	Process
4460	Lammer1.exe
688	Trojan.exe
2772	Trojan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1ab63eab1ed5ccd5c1889e531b858731 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1ab63eab1ed5ccd5c1889e531b858731 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lammer1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
824	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134156787153656367"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
1828	chrome.exe
1828	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3872	540	chrome.exe	88
PID 540 wrote to memory of 824	540	chrome.exe	89
PID 540 wrote to memory of 5020	540	chrome.exe	90
PID 540 wrote to memory of 5020	540	chrome.exe	90
PID 540 wrote to memory of 3672	540	chrome.exe	91
PID 540 wrote to memory of 3672	540	chrome.exe	91
PID 540 wrote to memory of 2872	540	chrome.exe	92
PID 540 wrote to memory of 5032	540	chrome.exe	93
PID 540 wrote to memory of 2872	540	chrome.exe	92
PID 540 wrote to memory of 5032	540	chrome.exe	93
PID 540 wrote to memory of 2528	540	chrome.exe	95
PID 540 wrote to memory of 2528	540	chrome.exe	95
PID 540 wrote to memory of 820	540	chrome.exe	97
PID 540 wrote to memory of 820	540	chrome.exe	97
PID 540 wrote to memory of 4600	540	chrome.exe	102
PID 540 wrote to memory of 1524	540	chrome.exe	111
PID 540 wrote to memory of 2164	540	chrome.exe	112
PID 540 wrote to memory of 2544	540	chrome.exe	113
PID 540 wrote to memory of 1828	540	chrome.exe	122
PID 540 wrote to memory of 1032	540	chrome.exe	124
PID 540 wrote to memory of 4460	540	chrome.exe	125
PID 4460 wrote to memory of 688	4460	Lammer1.exe	127
PID 688 wrote to memory of 1492	688	Trojan.exe	128
PID 540 wrote to memory of 4496	540	chrome.exe	132
PID 540 wrote to memory of 4496	540	chrome.exe	132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/eee6wy8iekaq0y1/Lammer1.exe/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbb362c728,0x7ffbb362c734,0x7ffbb362c740
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,5947574699256253261,18152800472898700626,524288 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,12986657103415007122,17981147491465100196,262144 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,6356782661585385445,5399974207590255860,524288 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,13195118789645276100,17641306558881659172,2097152 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,12226888220315781111,15848391961777235335,2097152 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,4478307295096619168,8256660362918147085,2097152 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4976,i,3000161342164727884,5126540966061716407,2097152 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,6142032865044968569,13995409914291813855,524288 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3336,i,4042800861476085082,8588656330156203521,524288 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,16620937136703613856,2431295467283850768,524288 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3252,i,206898700217059921,5727772974320810554,524288 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5672,i,15716640571733359312,5101679122022080023,262144 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4520,i,14093550281246570239,246016429089168274,524288 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:1032
- C:\Users\Admin\Downloads\Lammer1.exe
  "C:\Users\Admin\Downloads\Lammer1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Trojan.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:688
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,6379993348367264537,1364781552561891941,524288 --field-trial-handle=2156,i,12328756015634997047,16150602236655815360,262144 --variations-seed-version=20260129-010036.988000 --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2592

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.exe" ..
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 328c2af37a9e3c10e09407b841ad869f81d256a0695ea32d2a978d7e939d4de0
MD5 9422622cf73ecfa78c86cd14439efbc6
SHA1 5dbe14c7f2c5f870a07bfc140f04df6cce37c0b3
SHA512 3fc094b716cefe3f6093b56fedf392f3d8d738e0c768feae7d0b64fec2c98bdbe1e2480485a189ce8e3ba2b9301bbcaead393b1ec08a086ad2d15fe9477dabd5
TLSH
T1DDF07DB6CD21EC3708FC0B1D24A45A4AE75113172780585F3B3D820C8FB067F864581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 339335c30b36f12a061534c5e54ffc1e6a92105e8de35968c45ee60cf4484578
MD5 42c6e535a19ed24cf5011f4b998a1838
SHA1 2a1c02a9370cb38e258c9bf65b69de602fc308db
SHA512 045e07a7d74efbf3c9e7bb94a71016965751faab7dd14d6ee8562469bdc0289d5ecc9696a4c726b53481bcad50184d8bf102f341a7b1dd8972f276f6b07209d1
TLSH
T1F3E09A4CA1A12C43CF684674645FB84BE43040134DBD12B210C973E01483DB0A102867
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 589cc09ebbc476ee39e9dbc2b51299b353550c4f0cb81ea209686b94ebbeb3ed
MD5 2aead569043d25186b281c27602b1bcc
SHA1 01ed96e4da2a0730855095cbbae4ed636a00902c
SHA512 9994f7b6594ca65297491d9069f191420a859c22f0bc8cce50f633f46a21c7f0803da34eb06174236b8fbc310a41305d79b1c292f08cd6b6054e3265dcc058dd
SSDEEP 192:D0u1Kc25Bdgd7EslZ/4IYSi4VRx8A7h6VwQOUVjhVtxRzR:D0u1Kc25Bdgd7EslZ/4IYSi4VRx8A7ob
TLSH
T1E302CEF3C3E8D96E891156F8A6146F1BCE6C0B15432C3C5A88D4EE4BE3E24B2D25954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 a4136ee3d3fb00361a5d49f5aea9866ab9578d5c936693bc92acd9721e999b1b
MD5 7a4f9bd06a6e3a10b96220616b8add5e
SHA1 b522e671fb8054c913cf6e48c6f482f946a14033
SHA512 9020771cdda29f34975830c4adf1dfe263735ac95c49a559d6a7a8bf55e648ddcfbc83cb8e7e8a9bfe4485d451342c42f3e627678bac6085a6f7c737123fb28d
SSDEEP 192:D0uiSp25BdgdWEslZ/4IYSi4VeZVIinPi7h6VwQOUVsN:D0uiSp25BdgdWEslZ/4IYSi4VeZVIin0
TLSH
T12502CCF7C3E8DA2E891156F8A6146E1BCE6C0B15432C3C5AC8D4EE4BE3E24B2D25554F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e41551bc6f41bdce6fa1eeb57ee1a7c7387b4cb03f8cb6d68f414f25af89ddba
MD5 bb21d4d1487f9f08f1a148ccb88a7c85
SHA1 971411603aed17f9a88ca5f53ce2deceee806914
SHA512 74fcb14920a3172bb7634a47ad84ad23a87f3472e1cb4a875016a7cdad2eead8cdaba92e7faddbb96b1b052753a11a772434ea227891d11e40f087324d796931
TLSH
T1572149EBD2EEB467107E59A71E01B80D3A7AA835029164F8DE7A812C70878F31F07426
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 23e804fb4a7b42dfee0a60097283ee2ca905660ddb5b049300438a4757e94947
MD5 2d5fadcafa55141a0ca2bff0258b1883
SHA1 b5ee48e3308e9d00c9e93223d16d841e58043e94
SHA512 3ec329637f5f79272a12dc3e8f411ef2db5d4ec54769646dbcbcfaa1782365b986a57ad2060bcef51f77f6822e4ec6bef0ac799fb8ffa99a8dc4ce7d34d35d0b
SSDEEP 192:9R24g5Ec67v7KpAPRp2+dy9MHsb+WNnyvodII2FPy2TewkQVyIsnAUge:9R24+QD+UXgawCq2w2pe
TLSH
T1F142B52DEE15757B9CCBC21AFA2ABA57D7F5002130902E88EAFCC92C11E75CDA217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ca3d66b666bb1e28573ffec5fee9ef92d252ab3e37411834a7583d7cb5bb2c5b
MD5 c16ff3dee3618439dbde5a2ae7d10be9
SHA1 eec7a1bca946479b2d1d838a16584781d4473026
SHA512 a23e4d0a4c589a294e8d8b5030402e5ddf1d8cc5b1ee2ea008f67aeef0d052fa12ac24bb7baa63353ace8529e7a97b53ac8e8fc53aeb5db98efd92ba943742ed
SSDEEP 192:9R2kb5Ec6Av7KpnPRpL+dy9MHsb+WNnyvoNqeJy2TewkuVyIsnAUgE:9R2kFQc+lXvawCTec2NE
TLSH
T11C52C72DAD15797B9CCBC21AF92ABB53E7F5102231901E88EAFCC92C11E75CDA217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ea0606ba0f8b3216cbde620e3fdc65b8021fb027587682de54d803923050648c
MD5 7a0c1f83607263771190bd13baa76ab9
SHA1 ccaa39892b9e6d0b29869005a5a7a725319c09d4
SHA512 6377f9592637654dd5649902841e2fef3cb490a1c6416363689e9e7c80607156e4ae471b8472d013f5eab63c5cc5544d254174c759e093212db5000b873e35d4
SSDEEP 192:9R24b5Ec67v7KpnPRpL+dy9MHsb+WNnyvodII2Fwy2TewkuVyIsnAUgE:9R24FQD+lXvawCq2t2NE
TLSH
T15C52C72DED15797B9CCBC21AF926BB53E3F5102221901E88EAFCCA2C11E75CDA217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5e88fce9c6172a40df01ce9de4050a18332b814c92ab6475b501057a8d2c0385
MD5 a1c4f2158155cf51efd5318aa701d300
SHA1 b0644cf7009671a178f1f0fa55694d0a14eddf74
SHA512 a6245c01aeff69755cf1291ed71dbee6c22358bdc469357183d3da64c6e04c250736a48fd2038724a9a6a075fa059f6a5f09ec29ef9637fa11d1a2643bea5a98
SSDEEP 384:kajof7KxkXqKf/pUZNCgVLH2Hfgslpo7pLuLcifqrXODoD+ErU3OGHGpS9TjVJT8:kKof7KxkXqKf/pUZNCgVLH2Hfgsbo7pT
TLSH
T1EB7208676C0C9A774F94C6CCD81A7F4FADB5024B65DD886443FA9C2503D5ACF110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e5d918711047d308159a152cc7dd7b94d0cbe512a475e21eafc5e7bdc1829bda
MD5 ee023f08bdedbc6d66acb311e0b3e84d
SHA1 406253cc03218d51b09217e5ab44cfce206d125a
SHA512 c30362717c5330b7d8ffd2b6a1023bc1cdbc362bbf98c7f21d1ddad8fffd8694116e6e8ba6ad412751bcb7f1e2502753dcfe1443ef4259096d340d0b5fb24338
TLSH
T19CB0129180019949C11B02F4119204A871149F118729139563E46972982A7904124151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587ed0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587ed0.TMP
Size 96B
SHA256 08c748dd0eaacd5c36ae0eabc3573a1b41bee8c580c11e68d8e6d86dcd2ac193
MD5 76eeb45fcf7406a33de2c7d9bcb2765f
SHA1 c3bdced138e02f2cb441f0cd337767723bd1694d
SHA512 bb47714c9511ec8fc4e13e1550dcf28707b5a2b4a895de9774d2f14b4e9b50479933fefc62fb1f1e39c194d25f8d9be43be9dad24777edeaf23cf7f70ea9878b
TLSH
T1F0B02202C002A203C00283B03880C0CC3020EF32C203038A8AF00A22CC32B380020030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e5677d4086f0175f3c5a7c442dc0e72cadc16f4c15eb9e859d2bcfd1fed0fa54
MD5 4cee5f4447c55f75852a6020eeee7118
SHA1 6938a0edbd9c334ef68b8c3fd54651cfd42b47d1
SHA512 7cce2685448e633c7894968f1ad9782d951a0c661ac6e69eb6d7787fe95b52e0da9d764053deac2c465d3d1ca7959f89c4223a0bb634bab95c4ce9194549ee47
SSDEEP 1536:oKYvNLxGE3yl0oeIvHJ6mzGGPHNR4sfZHZw1KrYco5PXbJ4uYovwmkhL:tYFLx4l0otpbqGFR4zK8BzJPF4mkhL
TLSH
T11D9302A495F0DC2714A8C689B2C37F06CB9885CB9D03ED5C9BD43B4B46AB39AD343835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 88KB
SHA256 3bfabf80e5b1562fac056613b0408587d23fa6ae9a201cae1bc80e9dfa3b6516
MD5 28fdebda0578e2acb96eb808d6005860
SHA1 e3f07797280a209f25baa0e9a3fd623f7da8d027
SHA512 3dc6bfc5f0b68ce1d14e13084025b1d6720920034abb9663446e03a9ed895c0d1106cec26ca7a6689f1d2a99a501562c2b8cfc68f18077ceded2f2c736f56595
SSDEEP 1536:LuvNLxGE3yl0oeIvHJ6mzGGPHNR4sfZHZw1KrYco5PXbJ4uYovwmkhL:qFLx4l0otpbqGFR4zK8BzJPF4mkhL
TLSH
T1D59302649AF0DC2750ACC689B6C37F0ACF5885C79913DD8C9BC43B4B46AB3999353835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 89d864721e73f84128009ebfd86580d7d28b2e84d5ba5160e60b7c44437c1b4f
MD5 d68a040638599b0dd4a6eb6803cb905b
SHA1 9ddc43b3ee23eb11cbd502aab58293935e26890f
SHA512 53c4ef962805b9ff956fd118dd34bed981008b1f3ab75c028df29689d96f7a50a8b3615478c5d4cf52c25e2b70ea7a87f0cc7a794922ab8e0cb180f88cd80287
SSDEEP 1536:MKYvNLxGE3yl0oeIvHJ6mzGGPHNR4sfZHZw1KrYco5PXbJ4uYovwmkhL:ZYFLx4l0otpbqGFR4zK8BzJPF4mkhL
TLSH
T1F29302A495F0DC2754A8C689B2C37F06CB9885CB9D03ED5C9BD43B4B46AB39E9343835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 96b240bd2523c310dcffd8e3a62b439644d43fa062009a3843bfdff98020bd5e
MD5 fddd03866c44fe5cba662fc5f4454f27
SHA1 d89954aa6cac6af1b084cbce51ffb3288c23c34f
SHA512 8be15151fa3a2c0c096b9793a6d60835d752ee8e422dfe2134755bf613e6d9d11fb72906d42dc7c7096adfcdc085a348af16dddb2c970bde2d6e59112916e2fb
SSDEEP 1536:oOQevNLxGE3yl0oeIvHJ6mzGGPHNR4sfZHZw1KrYco5PXbJ4uYovwmkhL:TFLx4l0otpbqGFR4zK8BzJPF4mkhL
TLSH
T1769302A499E0EC2710A8C689B1C37F07CF5885CB8903DD9C9BD53B4B47AB39A9343935
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 b76402ce0af7e5c6deb39e1673286eaa130208f53ff254b2e61b7e0e9a2566e7
MD5 2c4c5642d71d8557c3a462182295cda3
SHA1 b8b9a6bc144e26457956d3dfb8bc43247ecdae2d
SHA512 ad457247b0219442398d6382d9a2ea1ec465ab52077f262188964f95d28148edb0432329726f92843e7403269e9d40ca159323828bf0fc49cf05d4010385990f
SSDEEP 1536:LOQevNLxGE3yl0oeIvHJ6mzGGPHNR4sfZHZw1KrYco5PXbJ4uYovwmkhL:qFLx4l0otpbqGFR4zK8BzJPF4mkhL
TLSH
T1DF9302A499E0EC2710A8C689B1C37F47CF5885CB8903DD9C9BD53B4B47AB39A9343935
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lammer1.exe

Path C:\Users\Admin\Downloads\Lammer1.exe
Size 23KB
SHA256 f515a557d974976970b5f13a033525b7264e8b154f64b99ebec2903d083be082
MD5 2123f376ae373eee5b829c1c4265955d
SHA1 49cd0bb8d6fa6405172a90bd6587d311fdd9c51a
SHA512 adad0e1deaa9153c711892d8a6c973f9012f0bf903a31caa21e33150a64a31688e9e6e0b3bd7746c0ef25d33a3c032509d892497f49e73b5e4f39b5a4b6ac0e7
SSDEEP 384:ZQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZpU:sLL6MVU0NRpcnuV
TLSH
T11BB2090E3FA98866C57C1B74C6B5965003B491470423EE2FCDC564DBABB3AD91D8CAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-258-0x0000000006230000-0x0000000006249000-memory.dmp

Download

memory/688-257-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/688-259-0x0000000006290000-0x00000000062F3000-memory.dmp

Download

memory/688-253-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1492-254-0x0000000000B50000-0x0000000000B69000-memory.dmp

Download

memory/2592-126-0x0000020F96F30000-0x0000020F96FDC000-memory.dmp

Download

memory/4460-234-0x0000000000CF0000-0x0000000000D00000-memory.dmp

Download

memory/4460-235-0x0000000074D72000-0x0000000074D74000-memory.dmp

Download