lunam | 02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 20:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe
Size 9.6MB
Sample260824-zksl2stdqa
SHA256 02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60
MD5 b260dacfdbf5e67fbf49eb2ce6deb397
SHA1 bfb83e4bd5f2651649f011d51198986ef20c59eb
SHA512 804274c94ef0adb0d28c55ea60bb4c050447d225218128a7cbec0c6eb6fbde38d93e12cb8429d1d164eae9534d048ab86411134863fb9f9faafaefadbae868ea
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4aN:b7H
TLSH
T1F2A6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 9 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024688-9.dat	family_lunam
behavioral1/files/0x0007000000024689-13.dat	family_lunam
behavioral1/files/0x00070000000244c5-48.dat	family_lunam
behavioral1/files/0x00070000000244c5-52.dat	family_lunam
behavioral1/files/0x00070000000244c5-56.dat	family_lunam
behavioral1/files/0x00070000000244c5-60.dat	family_lunam
behavioral1/files/0x00010000000237c0-62.dat	family_lunam
behavioral1/files/0x00070000000244c5-64.dat	family_lunam
behavioral1/files/0x00010000000237c0-66.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
1156	avscan.exe
1896	avscan.exe
4896	hosts.exe
1064	hosts.exe
3436	avscan.exe
4540	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4512	WScript.exe
1576	WScript.exe
3980	WScript.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1732-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x0007000000024688-9.dat	upx
behavioral1/files/0x0007000000024689-13.dat	upx
behavioral1/memory/1896-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1896-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1732-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1064-34-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3436-39-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4540-43-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1156-44-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4896-45-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00070000000244c5-48.dat	upx
behavioral1/files/0x00070000000244c5-52.dat	upx
behavioral1/files/0x00070000000244c5-56.dat	upx
behavioral1/files/0x00070000000244c5-60.dat	upx
behavioral1/files/0x00010000000237c0-62.dat	upx
behavioral1/files/0x00070000000244c5-64.dat	upx
behavioral1/files/0x00010000000237c0-66.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe
File created	\??\c:\windows\W_X_C.bat	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe
File opened for modification	C:\Windows\hosts.exe	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3852	cmd.exe
1684	cmd.exe
4076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2308	REG.exe
1268	REG.exe
1812	REG.exe
2540	REG.exe
872	REG.exe
5052	REG.exe
1216	REG.exe
3424	REG.exe
4288	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1156	avscan.exe
4896	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1732	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe
1156	avscan.exe
1896	avscan.exe
4896	hosts.exe
1064	hosts.exe
3436	avscan.exe
4540	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2308	1732	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe	87
PID 1732 wrote to memory of 1156	1732	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe	89
PID 1156 wrote to memory of 1896	1156	avscan.exe	90
PID 1156 wrote to memory of 4076	1156	avscan.exe	91
PID 1732 wrote to memory of 1684	1732	02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe	92
PID 4076 wrote to memory of 4896	4076	cmd.exe	97
PID 1684 wrote to memory of 1064	1684	cmd.exe	98
PID 4896 wrote to memory of 3436	4896	hosts.exe	99
PID 4076 wrote to memory of 1576	4076	cmd.exe	100
PID 1684 wrote to memory of 3980	1684	cmd.exe	101
PID 4896 wrote to memory of 3852	4896	hosts.exe	102
PID 3852 wrote to memory of 4540	3852	cmd.exe	104
PID 3852 wrote to memory of 4512	3852	cmd.exe	105
PID 1156 wrote to memory of 5052	1156	avscan.exe	108
PID 4896 wrote to memory of 1268	4896	hosts.exe	112
PID 1156 wrote to memory of 1216	1156	avscan.exe	119
PID 4896 wrote to memory of 1812	4896	hosts.exe	121
PID 1156 wrote to memory of 2540	1156	avscan.exe	123
PID 4896 wrote to memory of 3424	4896	hosts.exe	125
PID 1156 wrote to memory of 872	1156	avscan.exe	127
PID 4896 wrote to memory of 4288	4896	hosts.exe	129

C:\Users\Admin\AppData\Local\Temp\02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe
"C:\Users\Admin\AppData\Local\Temp\02084cd0343e26b79f3e6cc6d5bd6f7fcd56a4e454c3a8d8f45108023cffce60.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2308
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visibility of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3436
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3852
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4540
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4512
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1268
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1812
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3424
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4288
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:1576
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5052
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1216
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2540
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1064
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 9.6MB
SHA256 7e3d4801f39e3f1bc37da6b89522038ea57114d21efc905692b716dcec7c40ca
MD5 c0b6db073d421c348dc8b18566640bcc
SHA1 4f63e6e2769e77c2b7fda4366ca83c05c15a0861
SHA512 d55529599a0306caabc0811cc440999efa2445a874ea9fa306d1098b49bac0520c12caff640362901d6911cb00a4602ef70d13502d092b7c9eaa304b2dc15faa
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4a0:b7q
TLSH
T1BDA6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2172_1117837528\CRX_INSTALL\128.png
Size 19.1MB
SHA256 001df6860ebbd20737aa728026e83c72b67c4d9b1c6a1b5caf4fa49c71028996
MD5 6f57cf844b99d43a5e72c4f7d4685a25
SHA1 d639d6d47059a15ebdaa4b67ba45cec30b99ac8c
SHA512 aa9a7931604c33727fa70f6598581b37e47d3ac275cfabd5342fc2f749997c4c108b77c20e0add25cd5220ad9e3d201b2a3791a943170ad09f230f84dc2cfa13
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4aq:b707B
TLSH
T11317AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2172_1117837528\CRX_INSTALL\128.png
Size 28.7MB
SHA256 421f8abc5df42252c0c8415e5c256b66244b0744b21ed1fa389e4841abd09d62
MD5 e03e9d262b0588013884bc4b01bba4bf
SHA1 9068d3ef4e34a7729b50896565a1291401226ae2
SHA512 699ef10b15d47a0f4d7bd955738d590e1df2e4f75da371e6cad749639ebd1e90cecd16aced14536f354a1ec3b8af2b5b9f1cb098e0d9c7b6d91c4831e531b0ed
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4aa:b7K707u
TLSH
T15A67AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2172_1117837528\CRX_INSTALL\128.png
Size 38.3MB
SHA256 c28cf7fc55f55bc339eff028bf6b0b7e758d23d7078640dd6945919fa8b70606
MD5 2104a324f189311832dd0da0890ac966
SHA1 8cdf4c7bfa27e56e6114a2d4bf20874f055dd8ce
SHA512 4473c109aea3f3fa386f9f1e4d3f1e0a70eef0cd450addb2e766bc629938c59d9f5e508bbd4d76b1728e19d47d39191916ef42e517e6aac9338901e385412c92
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4aC:b707K707r
TLSH
T16997AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2172_1117837528\CRX_INSTALL\128.png
Size 47.8MB
SHA256 9f9be54a1c52c101e2ae13ed98a7fcd41c7e7566b682148d0e9f158aa6197f5a
MD5 d13b7eaa694bc0cec99a43f488ae5c4a
SHA1 c4ba7b69d9c5d7c23333c9f8b4e4765edf6ed3e6
SHA512 3d13545eee5f7c5eb67e0ea5955979fe965a5b615d7d2db0097ab624d2cee73b52e0287a07ee5960f55306a5b5fa47004b113275d7436316aec42d145187af19
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4aC:b7K707K7074
TLSH
T1F6B7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2172_1117837528\CRX_INSTALL\128.png
Size 57.4MB
SHA256 a9ff4be37487baca2f673eba9c51533ad50ce6983c7a6d4861b070e3c290e79e
MD5 6b3b96cef6c3873ddee244f21e3a8a61
SHA1 1ec6ff4cb00a22af089c13ed5a9a8db427c91396
SHA512 7f440de6cac5073c8baab99938378408e6b77d78776a17f121cc9408946f5d59bd1a16829c90ea927d3f3b31694c3a8420aa98a9be09a277d6075e3f99b15c5e
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4aU:b707K707K7077
TLSH
T18AD7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 47.8MB
SHA256 5edcfbc5e4ae456663b535824990f00bb1de926efa95977ed5fbdbec12f4e4d7
MD5 3adbf76cdd224db7bbbff61a0db2c6ea
SHA1 228d00dbdaf9fb100fb2fbe913e6c1ce6a7bbb7a
SHA512 3b3fc684b561ba92e49e4c52d0ab604e925237b2b232cf43280f001c770d3a5acbf4c63c9f12f135932a75907cb44c164298922ea52434699be3b39e8c6b4f4b
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4an:b707K707174
TLSH
T1FBB7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 57.4MB
SHA256 2cd9e29f4ab74e471844379e37dfad769de45a7fcdb8296b3ab77fa831e245e4
MD5 a3370bd43f3bd1a1472f4a76ebbb02b5
SHA1 83ec7d40260877394699bbf21983875df724bb3c
SHA512 d603658d14e0be5111c97b5e3e06d1910015b8737f897b3042eaf96e761fa096651db47aeedf4db080d6eb9b6de317d6d56e2e52b2beb9e068f888b27c07bc6a
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4a8:b7K70707K7077
TLSH
T14CD7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 6e1f1a5cf696df3d046d9f41dc8d79dbe266b6c8d84cb4e6527088dc5e2f3029
MD5 54e6b9b4bf49d02d6de6be7f3dadb921
SHA1 8a7634f87f967a66889d08f386c07f15f0ac4863
SHA512 30363aa7586f6142473bcc467cd4a0cfc8ccbca79c647cb23065499f40471f08451456e25489fa8b03c999b3d4480b3753d3fc9ff64c5651a7feec308d6e6273
TLSH
T14FD0C0D1662A4033C27671D2131AC0458774D0403132DB2196CDAC003133FC3407C2CF
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 9.6MB
SHA256 a3ea2e2a29471981420c91537442e7e69ac7910163cc45b711d924d2a3a16b21
MD5 c374bcf49d98495ea1214d321cc053c5
SHA1 a212d740afb804ac8909f14473ee416e5f66d468
SHA512 4e0cec008aad00141ea5e4dd0415bcbe947b15c79ab3177cc277e997e2f00fbbfce6d15cbdc257cc34268c6b4d9cc19154eb59dd10b380157f6d742f7aebb217
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSUaoS4aoSDaoS4ar:b71
TLSH
T16BA6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1064-34-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1156-44-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1732-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1732-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1896-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1896-16-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3436-39-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4540-43-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4896-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads