lunam | e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
Size 6.7MB
Sample260825-kdk63ayfpc
SHA256 e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc
MD5 a96be33859f53f70e4b60568f7472fb0
SHA1 8ab2a8182672fd9acf3078f8364e465d126fcf05
SHA512 eb8290a4aba08f1ccf09039203ae6f3c02b8a411e82fd70c39047c56b6d14d2da5011fa97fcf8d8379007d2ff3a1aceca678bfe524d22943cbe5f6f0afea777c
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4s:b77
TLSH
T1C466AF537757A50BF0268A390A11879D5396FE328E027897B2D03E3B3D332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 9 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e693-9.dat	family_lunam
behavioral1/files/0x000300000001e695-15.dat	family_lunam
behavioral1/files/0x00080000000244a3-47.dat	family_lunam
behavioral1/files/0x00080000000244a3-49.dat	family_lunam
behavioral1/files/0x00080000000244a3-51.dat	family_lunam
behavioral1/files/0x00080000000244a3-53.dat	family_lunam
behavioral1/files/0x00080000000244a3-55.dat	family_lunam
behavioral1/files/0x00080000000244a3-57.dat	family_lunam
behavioral1/files/0x00080000000244a3-59.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RPHJNYLJ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RPHJNYLJ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RPHJNYLJ = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
520	avscan.exe
1440	avscan.exe
4524	hosts.exe
4900	hosts.exe
2812	avscan.exe
3052	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
3748	WScript.exe
3432	WScript.exe
4036	WScript.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1948-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x000300000001e693-9.dat	upx
behavioral1/memory/520-11-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x000300000001e695-15.dat	upx
behavioral1/memory/1948-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1440-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4900-36-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2812-39-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3052-43-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/520-44-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4524-45-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00080000000244a3-47.dat	upx
behavioral1/files/0x00080000000244a3-49.dat	upx
behavioral1/files/0x00080000000244a3-51.dat	upx
behavioral1/files/0x00080000000244a3-53.dat	upx
behavioral1/files/0x00080000000244a3-55.dat	upx
behavioral1/files/0x00080000000244a3-57.dat	upx
behavioral1/files/0x00080000000244a3-59.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
File created	\??\c:\windows\W_X_C.bat	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
File opened for modification	C:\Windows\hosts.exe	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2660	cmd.exe
736	cmd.exe
208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4900	REG.exe
368	REG.exe
4136	REG.exe
3776	REG.exe
700	REG.exe
2436	REG.exe
4408	REG.exe
4548	REG.exe
1020	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
520	avscan.exe
4524	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1948	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
520	avscan.exe
1440	avscan.exe
4524	hosts.exe
4900	hosts.exe
2812	avscan.exe
3052	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1020	1948	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe	85
PID 1948 wrote to memory of 520	1948	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe	88
PID 520 wrote to memory of 1440	520	avscan.exe	89
PID 520 wrote to memory of 736	520	avscan.exe	90
PID 1948 wrote to memory of 2660	1948	e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe	91
PID 2660 wrote to memory of 4524	2660	cmd.exe	94
PID 736 wrote to memory of 4900	736	cmd.exe	95
PID 2660 wrote to memory of 3748	2660	cmd.exe	97
PID 4524 wrote to memory of 2812	4524	hosts.exe	98
PID 736 wrote to memory of 3432	736	cmd.exe	99
PID 4524 wrote to memory of 208	4524	hosts.exe	100
PID 208 wrote to memory of 3052	208	cmd.exe	102
PID 208 wrote to memory of 4036	208	cmd.exe	103
PID 520 wrote to memory of 4136	520	avscan.exe	112
PID 4524 wrote to memory of 3776	4524	hosts.exe	115
PID 520 wrote to memory of 700	520	avscan.exe	118
PID 4524 wrote to memory of 2436	4524	hosts.exe	120
PID 520 wrote to memory of 4408	520	avscan.exe	122
PID 4524 wrote to memory of 4900	4524	hosts.exe	124
PID 520 wrote to memory of 4548	520	avscan.exe	126
PID 4524 wrote to memory of 368	4524	hosts.exe	128

C:\Users\Admin\AppData\Local\Temp\e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe
"C:\Users\Admin\AppData\Local\Temp\e97c9b1fdac4218fba9c7a15d5a9c29525b7ad927c90502e2615a1b43db095bc.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4900
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:3432
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4136
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:700
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4408
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3052
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4036
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3776
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2436
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4900
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:368
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 6.7MB
SHA256 bf1d21192f0cd8c633a49824609cd8e6a6fc0b9d64516f147176b2d285180d5f
MD5 b816a7f9c4efdbaa8379173079501544
SHA1 c2ec6ae6b4970f725d2ecbbefb68c80be2121522
SHA512 75200db4dc18b778793e338295fd9eabff52c2079076021aaa831d5575d683f44ba3abcf50eb95be6e5d0f7d7d50b3ea78d6bbb322479504410c62ca7d6c37d7
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4e:b7R
TLSH
T13866AF537757A50BF0268A390A11879D5396FE328E027897B2D03E3B3D332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4348_576495791\CRX_INSTALL\128.png
Size 13.5MB
SHA256 9011bb22b02209742859ccbd12b5272a5d80d4e37127eb4820dca558b0b35205
MD5 020d09d8698c6e7d184fd97024de8f8c
SHA1 130287d00bdf63460a1ed7327aa96d22e5329fd5
SHA512 b30fdd2e37a4d634cfb0654db50f2bb92adeae670be426f15429fbd8c44160f908f63656e6ccb68873a68b7995257b3f4f5218326946d02b5394183e0ad883d7
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS45:b7h7u
TLSH
T195E6AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4348_576495791\CRX_INSTALL\128.png
Size 20.2MB
SHA256 34c6d3dc0ae288cff4bb56f927376e528648e92a25a51c83f18784e098ed9940
MD5 dfa8a2e58c86b4bdb8679f1ba4ebacd0
SHA1 2df6ea285bc3ee38f681dde64304eb690d7f2273
SHA512 b93eebf2c06f35902427c88b4741faac79ba9d8741007913864b50c0e20eb51fdec98d6a420a42594b04dedc95636fcca8a46b0b6a1678805e438ff21dd96e36
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4h:b747h7l
TLSH
T17827AF537757A50BF0268A390A11879D5396FE328E027897B2D03E3B3D332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4348_576495791\CRX_INSTALL\128.png
Size 27.0MB
SHA256 ad5a899806d0394e48977c0d0a3c530cb8b5d77266637e199e40db36b9e52306
MD5 b70a2dc6c6cc9b4f52c01c7bd4473349
SHA1 0a241d59c07227858583991b2b3eff866f7f205b
SHA512 a6aeacfdac899626e6c29be0baca728984fd9f64f7b46ba5209c564b55dad1ed87fd3fed0f5c7ce10dad5b6a40c8d2e1f50c7f6b63a8d0c4b4ec9581aa142563
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS41:b7h747h7p
TLSH
T10B57AF537757A50BF0268A390A11879D5396FE328E027897B2D03E3B3D332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4348_576495791\CRX_INSTALL\128.png
Size 33.7MB
SHA256 b2c2c2c44d5c661f674a349e1a756f513a4de00bfad9a5892ea4ac34aa0a5f1e
MD5 9a87cefc190afde85517b894a44eef13
SHA1 7fe5ffadedb82afac4ed796ca5df6e8edb611872
SHA512 514f6856f370273f7077f55b38560f528efb924a1445304e6f9c094e6a26b8f94d469799bccaac77efe9722555db194c9f13ad6a0e8c5bd50df52c30fd37273b
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS41:b747h747h7W
TLSH
T13B77AF537757A50BF0268A390A11879D5396FE328E027897B2D03E3B3D332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4348_576495791\CRX_INSTALL\128.png
Size 40.5MB
SHA256 4557def4df28d13f475ed5ba5cbb57e7c8ad944ff79986380cc1c641bb78a3c5
MD5 cac3d6e38beb16e9f5eea707dded3658
SHA1 9e634c33d0c3f6606d932fa381240605b47cb941
SHA512 4503b00bc61720726060bd1dd70aa5fde77ecda2b886fbcaf9316158847a9040281403503aaba61cafff35fef78bbee0e712d4629be5350cca6dcbe9b34ea80b
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS45:b7h747h747h7W
TLSH
T19697AF537757A50BF0268A390A11879D5396FE328E027897B2D03E3B3D332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4348_576495791\CRX_INSTALL\128.png
Size 47.2MB
SHA256 a85ac7182bc14f6f9c72fac712a00f7d87bb81ce4b7360cc5aa79cb30af44090
MD5 1ebb19caa471480ed50d2d5ec3e6f38f
SHA1 7dfee6eb8347c28613ab9ba723e5d408bc8a0b7d
SHA512 f427db7ee14bc52da477841234a3efc38027442c64ea00ded677383ed88b414b9c50a95d1f74496f7a3acc73430f169e3555b88ee1920fb5b628b1de39c3175e
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4p:b747h747h747h79
TLSH
T103B7AF537757A50BF0268A390A11879D5396FE328E027897B2D03E3B3D332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4348_576495791\CRX_INSTALL\128.png
Size 54.0MB
SHA256 44b7f7a7ba11673eea65d63372bf57dee5f55b2b87907b43964497d9a777c166
MD5 ad262295651216c37a79b4f89765e1a6
SHA1 7f97a7cb8c5efd2723b30fceb552c942dcaeda9b
SHA512 8aa8474fb946f20b88eaad6ee8925101eea61cb2c170eb2eb414d4965d41f4d832f8ada700529afa075a15543f7b10e1cb5311e8212f18fef1b2639d096da647
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4W:b7h747h747h747h7K
TLSH
T131C7AF537757A50BF0268A390A11879D5396FE328E027897B2D03E3B3D332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 179ba010908d33b071f724cf63498ae72f0ba81c24ac9e597481ddaaeb777053
MD5 e8ce93dc3403e787224a08b907dabfed
SHA1 baa3ff72f84d74ad3ba65b407665108bac09d33e
SHA512 c94bc94e77b614079d660e5a5c3a5a55cc1a02656520309dde631a4352cfa6c585ac30cc62d608396a04d9517606bdeec830af6e2cb84681a6dcb06578ef98ce
TLSH
T1F6D012D2662685239276A1D103199445477491413572DF25A189A9556172AB7407828F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 6.7MB
SHA256 b1f791ac7852cfc1565bec988e714e7a41078c5f860daf8d98f2cc44f58f5f6b
MD5 f2f631afb58edce32e24a5fc7f645760
SHA1 33abe5a41ce16ef5924629049cf63f4a7c0c1f27
SHA512 7cb00e2b65481707de9a544289f089a5ccdcf44410ec9e8d750d3b3028b31e15e0c80ee10dc19a03ebca16f215889afea1961e5b4a01fb1515cf00ff184591db
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSJBaoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4F:b7O
TLSH
T1AA66AF537757A50BF0268A390A11879D5396FE328E027897B2D03E3B3D332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/520-44-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/520-11-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1440-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1948-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1948-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2812-39-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3052-43-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4524-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4900-36-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads