lunam | 202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
Size 5.9MB
Sample260825-mxvkyshk7t
SHA256 202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa
MD5 eff9601f9721fa4a9e5b2e82329175c0
SHA1 1f6ba4861ceb733c301aead837d0ce6d3a2564c5
SHA512 19fd3b908615f3a6fde3cc2d88e55fc240ccaea06f6611f52672610960337151526d1ed9bc5ad70d13873b532e8b5c817f84e18760b7c21e69560123e0ff5bb3
SSDEEP 12288:b7IoSkaoSC7IoSkaoSfaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4o:b7f7V
TLSH
T105568E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 9 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244c8-9.dat	family_lunam
behavioral1/files/0x00070000000244c9-13.dat	family_lunam
behavioral1/files/0x0007000000024439-47.dat	family_lunam
behavioral1/files/0x0007000000024439-49.dat	family_lunam
behavioral1/files/0x0007000000024439-51.dat	family_lunam
behavioral1/files/0x0007000000024439-53.dat	family_lunam
behavioral1/files/0x0007000000024439-55.dat	family_lunam
behavioral1/files/0x0007000000024439-57.dat	family_lunam
behavioral1/files/0x0007000000024439-59.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VGXMSUXF = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VGXMSUXF = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VGXMSUXF = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
1668	avscan.exe
4672	avscan.exe
1216	hosts.exe
4312	hosts.exe
1080	avscan.exe
556	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4920	WScript.exe
3792	WScript.exe
4408	WScript.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3364-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00070000000244c8-9.dat	upx
behavioral1/files/0x00070000000244c9-13.dat	upx
behavioral1/memory/4672-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3364-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4672-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4312-38-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1080-39-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/556-43-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1668-44-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1216-45-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x0007000000024439-47.dat	upx
behavioral1/files/0x0007000000024439-49.dat	upx
behavioral1/files/0x0007000000024439-51.dat	upx
behavioral1/files/0x0007000000024439-53.dat	upx
behavioral1/files/0x0007000000024439-55.dat	upx
behavioral1/files/0x0007000000024439-57.dat	upx
behavioral1/files/0x0007000000024439-59.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
File created	\??\c:\windows\W_X_C.bat	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
File opened for modification	C:\Windows\hosts.exe	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
940	cmd.exe
5044	cmd.exe
2848	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1952	REG.exe
420	REG.exe
4484	REG.exe
2088	REG.exe
4304	REG.exe
932	REG.exe
2688	REG.exe
2440	REG.exe
1816	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1668	avscan.exe
1216	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3364	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
1668	avscan.exe
4672	avscan.exe
1216	hosts.exe
4312	hosts.exe
1080	avscan.exe
556	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 1952	3364	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe	86
PID 3364 wrote to memory of 1668	3364	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe	88
PID 1668 wrote to memory of 4672	1668	avscan.exe	89
PID 1668 wrote to memory of 940	1668	avscan.exe	90
PID 3364 wrote to memory of 5044	3364	202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe	92
PID 5044 wrote to memory of 1216	5044	cmd.exe	94
PID 940 wrote to memory of 4312	940	cmd.exe	95
PID 1216 wrote to memory of 1080	1216	hosts.exe	97
PID 5044 wrote to memory of 4920	5044	cmd.exe	98
PID 940 wrote to memory of 3792	940	cmd.exe	99
PID 1216 wrote to memory of 2848	1216	hosts.exe	100
PID 2848 wrote to memory of 556	2848	cmd.exe	102
PID 2848 wrote to memory of 4408	2848	cmd.exe	103
PID 1668 wrote to memory of 420	1668	avscan.exe	112
PID 1216 wrote to memory of 4484	1216	hosts.exe	115
PID 1668 wrote to memory of 2088	1668	avscan.exe	117
PID 1216 wrote to memory of 4304	1216	hosts.exe	119
PID 1668 wrote to memory of 932	1668	avscan.exe	122
PID 1216 wrote to memory of 2688	1216	hosts.exe	124
PID 1668 wrote to memory of 2440	1668	avscan.exe	126
PID 1216 wrote to memory of 1816	1216	hosts.exe	128

C:\Users\Admin\AppData\Local\Temp\202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe
"C:\Users\Admin\AppData\Local\Temp\202d9083cdb067322a8b8ab275ea9c0b2d25d6ca8e9921f0f6745b3bdda0c9fa.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4312
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:3792
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:420
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2088
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:932
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:556
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4408
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4484
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4304
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2688
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1816
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 5.9MB
SHA256 c4550c13ce2ae20f463cd0ae7ee9903fc24484444c135cf22007d03f6c78e9a1
MD5 df606aca567c06fdb519db27a8387f15
SHA1 f4c86d7af1ff53c523cb384d674408b33d2acd56
SHA512 4a2cf4add468ce11a320af6ec0770c068202e3220599fc11c8bec4fdcee545dd3e67ab897becaa3268956b4e831ec735e86dc2b9944b5351698249270face97a
SSDEEP 12288:b7IoSkaoSC7IoSkaoSfaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS40:b7f7f
TLSH
T1BC568E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_937133956\CRX_INSTALL\128.png
Size 11.8MB
SHA256 74c8b8def00dbeb57e57f13d8717a14af1d2828d81c632aabbcdbefb070d67e1
MD5 379084bdee677cc4a52211cb526f6fa8
SHA1 de19fd27e8c96fd1412e1cb37ee821ee172236c0
SHA512 79d4d4ad77328a7829f6156d3c6622ea6fa8d281c36a21d78d2af678910dad5655abe245a79ad462f58027382014b9bc2bc9078226b90514f20d1ec431dfe1d1
SSDEEP 12288:b7IoSkaoSC7IoSkaoSfaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4h:b7f7N7f7y
TLSH
T144C68E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_937133956\CRX_INSTALL\128.png
Size 17.7MB
SHA256 9b83216a5eda58c1ba9a4a4b8a7a39d00a5eabaf2b9028adb833fb9a6f7d21e4
MD5 ad4017c8eb9b42a18efabab5cc5ad169
SHA1 8a7024ea79e7101736864582e04ffb2d0d93f4ff
SHA512 0db9185088cc5983a4bcfeacbd649330fa125bda79182561ba48d6ecbe74803bc58c12181fc5d6476c7f2e5ed451a094317cdee783a7b30569dc7e9f8b13d3dd
SSDEEP 12288:b7IoSkaoSC7IoSkaoSfaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4q:b7f7v7f7N7f7d
TLSH
T1A1178E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_937133956\CRX_INSTALL\128.png
Size 23.6MB
SHA256 407c572971fa2a6e2e704240d4f765077df65aa5d2016621c21f4ad5de935bd3
MD5 97306c327e57fdd2de4c0ea4569e853f
SHA1 ee9191462313abc0b572fc4a78ce70ca810bbbea
SHA512 043a552587d8c2f58a66060b1c61c3734857bceeecbec40185ff2a8b92bde8bb840219abae31dfe32cab910ca3665105233cde4b107c7fbb25f92d68cc4b3875
SSDEEP 12288:b7IoSkaoSC7IoSkaoSfaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4b:b7f7N7f7v7f7N7f74
TLSH
T10E478E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_937133956\CRX_INSTALL\128.png
Size 29.5MB
SHA256 db6e34efcb6ed726fa12e2539f45a8675029fad8989ce1e42b0f3c4ce2c8e2c5
MD5 7b4f28ce68648da28e66327277bae9db
SHA1 712696b01ec3a3f9a4bc921c1eb88e779bdeb261
SHA512 c84f147b0b0046425d057a55600cfb338df553684cbd0db498e9e7078f4910e4d57dd1d5c4cfe17f42633ac8d1148b03f382c2d706d7a71fc4f6b3166b550375
SSDEEP 12288:b7IoSkaoSC7IoSkaoSfaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4c:b7f7v7f7N7f7v7f7N7f73
TLSH
T175678E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_937133956\CRX_INSTALL\128.png
Size 35.4MB
SHA256 b1b7df73286b355be631951b5dd298b7bff09586c170f1763bd68af59d8b11ae
MD5 c3f7952e795b331857e7f211ef3a3628
SHA1 0fa7fe4a4c57af37553887969e09e9d3b225d0b8
SHA512 611982c46a0b97c4c716f160048bd468beb202bf6a78a6c88f4879749310cd42ff583919631150b3f2dc92ae73f4bcc9df8c9a29f70b5daf169edaa4ab247a8b
SSDEEP 12288:b7IoSkaoSC7IoSkaoSfaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4b:b7f7N7f7v7f7N7f7v7f7N7f7I
TLSH
T172878E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_937133956\CRX_INSTALL\128.png
Size 41.3MB
SHA256 70642a9dadeaef05a27396a59c816cae1c4f6954e900adaee32c156e0a96cccf
MD5 b6b5673fa91150d8fbccc5eae0aef734
SHA1 fb4d4a882e7c1db0a97d67cabc0b0dba7d9fe3d8
SHA512 a9843c3dd40aeb1551acb552c2ed870fd0b93246821a0d8f64629190ca3f2ff6d413d6bdcca118026ae9d21c8cedf9b54329f5ccb12d1c144aa38d9b1556d5ca
SSDEEP 12288:b7IoSkaoSC7IoSkaoSfaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4U:b7f7v7f7N7f7v7f7N7f7v7f7N7f7b
TLSH
T1F5978E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_937133956\CRX_INSTALL\128.png
Size 47.2MB
SHA256 e695ba3ba44aa5c6ccac903d5c60ab6f79da3e87be7e124993cb16410d09212f
MD5 9a1e99bc25a834e3f5de168f5b794091
SHA1 c916c0206bda2aae92aec175a2140e611b270e43
SHA512 4813b4a6bb7c64e3bd2212bd067b0b9676e6571498e081971e19f0a3e8c50103db56281fb33f20b73ee14f2d9964b3d189870222a7789a81c6dcc892d91c4236
SSDEEP 49152:b7f7/7fTv7f7N7f7v7f7N7f7v7f7N7f7A:bbTbbbZbDbZbDbZb0
TLSH
T148B78E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 4203dc4f2e3217346a617f2120ee625c5e2449ed925e45f5b5fe9927e824059d
MD5 2b4ebd9408471a5999a89fecc87d81a5
SHA1 4d03a4734873ccf3bfed059ce4f2e077c0762b3d
SHA512 4620f9989bcd4770aaaa41da6c732624af4dc419e3b4548412e8af244de369c3781f58b3bdfadb5b0628a51b6f04f0ea339a69ccaee90fa2d8aa7506137e57ab
TLSH
T130D012A166268523927271D1131984864774A1413672DB25918DA9652136B97807868F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 5.9MB
SHA256 3f1c5707630d5a1f8e1c140d98507f29d0ef1e537e3567c9cae3598318ff2696
MD5 352df3a9be30f815411a443623eb7b81
SHA1 3d564f2f5c5e90f391d3c65bb309632019d2fac9
SHA512 e08201356f4e1e53bbbbaee43ac803290e34cbb21681eca5ad8a620675d2504ab471d337aa2b4e00994d484532deb82d494d7b5b3d22671a745496234a65bd9a
SSDEEP 12288:b7IoSkaoSC7IoSkaoSfaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4U:b7f7l
TLSH
T198568E53B757A50AF02689391A11879D5396FE328E027857B3903E3B3C332CB7E69971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-43-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1080-39-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1216-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1668-44-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3364-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3364-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4312-38-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4672-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4672-16-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads