lunam | db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
Size 9.2MB
Sample260825-j73sjayemb
SHA256 db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4
MD5 9e321f73212353d29abe6846cccdb153
SHA1 b0d9dfb1cdd323f2446d7165061017770d4f7aa1
SHA512 afce949d89cdbfba152566460da58550f14b08f44400d9c33a4081f7ff6df431ae28d2e9f0f7fa264241bba4e787e651d1c166f4a232e6ed362a14c020f60055
SSDEEP 12288:b7IoS/aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSJPaoSDaoS4aoSDaoS4aoSDaoS4z:b74
TLSH
T174A6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243f4-9.dat	family_lunam
behavioral1/files/0x00070000000243f5-13.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XHBCZSSI = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XHBCZSSI = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XHBCZSSI = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
2704	avscan.exe
3948	avscan.exe
2172	hosts.exe
4152	hosts.exe
3520	avscan.exe
4948	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4244	WScript.exe
3100	WScript.exe
3540	WScript.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1256-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00070000000243f4-9.dat	upx
behavioral1/files/0x00070000000243f5-13.dat	upx
behavioral1/memory/1256-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3948-20-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2172-30-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4152-37-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3520-40-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4948-44-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2704-45-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2172-46-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
File created	\??\c:\windows\W_X_C.bat	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2232	cmd.exe
3020	cmd.exe
3404	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
5076	REG.exe
2952	REG.exe
1972	REG.exe
3440	REG.exe
456	REG.exe
4756	REG.exe
1100	REG.exe
1900	REG.exe
1564	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2704	avscan.exe
2172	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1256	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
2704	avscan.exe
3948	avscan.exe
4152	hosts.exe
2172	hosts.exe
3520	avscan.exe
4948	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 5076	1256	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe	86
PID 1256 wrote to memory of 2704	1256	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe	88
PID 2704 wrote to memory of 3948	2704	avscan.exe	89
PID 2704 wrote to memory of 3020	2704	avscan.exe	90
PID 1256 wrote to memory of 2232	1256	db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe	91
PID 3020 wrote to memory of 2172	3020	cmd.exe	94
PID 2232 wrote to memory of 4152	2232	cmd.exe	95
PID 3020 wrote to memory of 4244	3020	cmd.exe	97
PID 2172 wrote to memory of 3520	2172	hosts.exe	98
PID 2232 wrote to memory of 3100	2232	cmd.exe	99
PID 2172 wrote to memory of 3404	2172	hosts.exe	100
PID 3404 wrote to memory of 4948	3404	cmd.exe	104
PID 3404 wrote to memory of 3540	3404	cmd.exe	105
PID 2704 wrote to memory of 4756	2704	avscan.exe	115
PID 2172 wrote to memory of 1100	2172	hosts.exe	118
PID 2704 wrote to memory of 1900	2704	avscan.exe	121
PID 2172 wrote to memory of 2952	2172	hosts.exe	123
PID 2704 wrote to memory of 1972	2704	avscan.exe	125
PID 2172 wrote to memory of 1564	2172	hosts.exe	128
PID 2704 wrote to memory of 3440	2704	avscan.exe	130
PID 2172 wrote to memory of 456	2172	hosts.exe	132

C:\Users\Admin\AppData\Local\Temp\db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe
"C:\Users\Admin\AppData\Local\Temp\db66aa709dfc577ef99a93d78eef7d6e48a57991bd211d938785d47ddb4b1cb4.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visibility of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3520
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3404
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4948
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3540
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1100
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2952
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1564
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:456
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:4244
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4756
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1900
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1972
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4152
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 9.2MB
SHA256 31e0ed4111060d5c266d15e06c8394935e9859e0fc6a5c1172884e95449b9b4d
MD5 1501b665e8291192c7b4186b2921168c
SHA1 49f9a63b6077752de32620e4b958412ada11c331
SHA512 42038e70db1a86a825b36604f5bed1f3b67940c5e5b8a902eab4388edccfbb0a0998090cc2ca4ae18291eeea588675779dfecf2c157bde0a3722d95db0c0c9ac
SSDEEP 12288:b7IoS/aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSJPaoSDaoS4aoSDaoS4aoSDaoS47:b7Y
TLSH
T16BA6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 b39688c8dc37d88a1280ec43e1005296491faecd1e150cbf2e1159f17f34b518
MD5 e0bbeba8855aa71af96d69acbab63649
SHA1 0a82aebac177670d8d342b6f13b3550e00e40a4d
SHA512 05e0400305d2e6ebec51c776993ae6654d87afdcf2454dbd4acca0206f8f5bd30f2041953ed75ff4530794c39bd9fedebb03c8faa286fa6fb8459a53dc5fef47
TLSH
T1CBD0C0D1662245339232F2D00309C4054734D0013132DB21A1CCAC003133FC3407C28F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 9.2MB
SHA256 70b8c100fe4e0651e3c56e51a18c84565146943ff412e9449c5d51a535f9f300
MD5 7365c07c643f330d48302fd0bd2dbea1
SHA1 14f7ef6fd9cbff6b28a4d88427528f9244dc61c1
SHA512 5d49ac270b3abb40c65a15cb23f689c1be2f3f473d247da2e14c2aad5c50c72cd8ac7763b11665f880845f6fed8237fed84d0da404590668258afe114ca97777
SSDEEP 12288:b7IoS/aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSJPaoSDaoS4aoSDaoS4aoSDaoS4J:b76
TLSH
T1F5A6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1256-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1256-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2172-30-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2172-46-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2704-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3520-40-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3948-20-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4152-37-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4948-44-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads