lunam | 49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
Size 8.0MB
Sample260825-phlevaysgs
SHA256 49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395
MD5 c8ded4989222dc2660ca1ff3c2b52b75
SHA1 7a1d1dd697507e199aeed217faf2d98217043d8e
SHA512 19e0231d7e76a29989acdf71e0a09ac05e86a90c21648fa8a9a4a133918dc56c87dca60aae1fd79c3674a329f77656c682f3ff6dad063acae009794f320d7c01
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSHaoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoSDa2:b77
TLSH
T1AF86AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 8 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024402-10.dat	family_lunam
behavioral1/files/0x0007000000024403-14.dat	family_lunam
behavioral1/files/0x00090000000241db-47.dat	family_lunam
behavioral1/files/0x00090000000241db-49.dat	family_lunam
behavioral1/files/0x00090000000241db-51.dat	family_lunam
behavioral1/files/0x00090000000241db-53.dat	family_lunam
behavioral1/files/0x00090000000241db-55.dat	family_lunam
behavioral1/files/0x00090000000241db-57.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XWFPSFRW = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XWFPSFRW = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XWFPSFRW = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
788	avscan.exe
4224	avscan.exe
4420	hosts.exe
2236	hosts.exe
4704	avscan.exe
412	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4176	WScript.exe
4928	WScript.exe
4828	WScript.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2372-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x0007000000024402-10.dat	upx
behavioral1/memory/788-11-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x0007000000024403-14.dat	upx
behavioral1/memory/4224-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2372-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2236-36-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4704-39-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/412-43-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/788-44-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4420-45-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00090000000241db-47.dat	upx
behavioral1/files/0x00090000000241db-49.dat	upx
behavioral1/files/0x00090000000241db-51.dat	upx
behavioral1/files/0x00090000000241db-53.dat	upx
behavioral1/files/0x00090000000241db-55.dat	upx
behavioral1/files/0x00090000000241db-57.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
File created	\??\c:\windows\W_X_C.bat	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
File opened for modification	C:\Windows\hosts.exe	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1188	cmd.exe
3808	cmd.exe
1752	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2108	REG.exe
4928	REG.exe
2200	REG.exe
4612	REG.exe
1548	REG.exe
2816	REG.exe
3520	REG.exe
2564	REG.exe
2836	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
788	avscan.exe
4420	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2372	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
788	avscan.exe
4224	avscan.exe
4420	hosts.exe
2236	hosts.exe
4704	avscan.exe
412	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2108	2372	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe	85
PID 2372 wrote to memory of 788	2372	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe	87
PID 788 wrote to memory of 4224	788	avscan.exe	88
PID 788 wrote to memory of 1188	788	avscan.exe	91
PID 2372 wrote to memory of 3808	2372	49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe	92
PID 3808 wrote to memory of 4420	3808	cmd.exe	95
PID 1188 wrote to memory of 2236	1188	cmd.exe	96
PID 4420 wrote to memory of 4704	4420	hosts.exe	98
PID 1188 wrote to memory of 4928	1188	cmd.exe	99
PID 3808 wrote to memory of 4176	3808	cmd.exe	100
PID 4420 wrote to memory of 1752	4420	hosts.exe	101
PID 1752 wrote to memory of 412	1752	cmd.exe	103
PID 1752 wrote to memory of 4828	1752	cmd.exe	104
PID 788 wrote to memory of 1548	788	avscan.exe	109
PID 4420 wrote to memory of 2816	4420	hosts.exe	112
PID 788 wrote to memory of 3520	788	avscan.exe	122
PID 4420 wrote to memory of 4928	4420	hosts.exe	124
PID 788 wrote to memory of 2564	788	avscan.exe	132
PID 4420 wrote to memory of 2200	4420	hosts.exe	134
PID 788 wrote to memory of 4612	788	avscan.exe	137
PID 4420 wrote to memory of 2836	4420	hosts.exe	139

C:\Users\Admin\AppData\Local\Temp\49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe
"C:\Users\Admin\AppData\Local\Temp\49e83c798fad351ed0a85e1412c87db2f30d6784a8b4519254c1884b13ee6395.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2108
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2236
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:4928
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1548
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3520
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2564
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:412
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4828
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2816
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4928
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2200
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2836
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 8.0MB
SHA256 9e006182879a56246f9112f2933d2b0a1d7c9e018ed5eac0108529a3285e3da8
MD5 bdbb0eb48cc5bd25119f2ebb531087d7
SHA1 159ad9167cdd7d9b5f9b0d468e87194d599d8846
SHA512 6c2c97a07740e3d3253c56dc24583942719f3b2ac214d6084d3d5172b4ff9899840658792a3799b3e924e35a2ee341f3dfbd4cb2573c05c13f815b67b15527ee
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSHaoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoSDaQ:b7R
TLSH
T10086AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_609822704\CRX_INSTALL\128.png
Size 15.9MB
SHA256 1435caad2bc96d048f411692b4f4ddb5148005d08180c363692ac91c07533252
MD5 482d4aefe58fdca6f6d3e02ecf428a67
SHA1 2ec577c9f364e0c3af8286e67925519471aae765
SHA512 139f8dfb97daa1bb5ad60a51d40ffede1fc92a667d6441767ec3275f82d75b07f874c18920215c9f27b7ede1bec1d0997d240118b43d4295d465a4161ff82a79
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSHaoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoSDas:b737V
TLSH
T1F0F6AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_609822704\CRX_INSTALL\128.png
Size 23.9MB
SHA256 0c8f59ef5b3cd2947e982244d566eb2cfcb4c50a9c4f453e88106d2fbed7dbb2
MD5 62966dddb9075f05965de50d51dd321f
SHA1 d463559868c963d5b0c783b1d2d0f36f9e8c7e64
SHA512 abdf75b098aa340bbadc1355d583d4a6a6d5b44bcbcc606e24fb8d46152bb1f176b65e2e8df79b3528fc7ac59de13311eea2787480c61f159546f09ddafaa840
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSHaoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoSDaA:b7m737a
TLSH
T1C347AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_609822704\CRX_INSTALL\128.png
Size 31.8MB
SHA256 c41bdec89d96158e74b631f702190aed5069c85feef373e69fcbb71268f78926
MD5 c6f0e406d6bd67047a98ec9545641680
SHA1 aec32d65bcaf3fd1ad672d9a163bf70a85d0813f
SHA512 404f30bad502dd7944f104af91d05a1d3d82289a3b9c033f4f78fc2a55eae3872f6236992bdc62e1b98d3b60f4c5e6d8846586f9ea95e8b9b3133872f318531f
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSHaoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoSDad:b737m737P
TLSH
T10277AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_609822704\CRX_INSTALL\128.png
Size 39.8MB
SHA256 4ef5813fd966f001c6d034858dceaa88bf160dcedda797577735f74ebb0ae097
MD5 6b9095c208d1216b50a51d901a219002
SHA1 a608154af886d3d946fb85d9c4832b22da573845
SHA512 f017d7a8394dccf21afef3e467269e7b58449fe78720f5524e806262dd4758533e9aceac2b44e803138ab42e7a117211c63a6aba646c59848135283847c2a027
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSHaoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoSDa1:b7m737m737E
TLSH
T14F97AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_609822704\CRX_INSTALL\128.png
Size 47.8MB
SHA256 95f1f627872428b254e57e19fd3e14addc082b54a52c8d0f37e3f2f96ccae3e8
MD5 4e4d4f3e8519cc5c06da43a46646e73f
SHA1 0f7838c9ed8b5846b6a757ab5bb67478640786d3
SHA512 509943a516f20982ecdf5ada2a55b5da9ccf0edb41f75634b8b46d899a3408613e3ce56fc1aad5034473bf51b28ad084f684487d6846c7be695866c1312a1bc7
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSHaoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoSDaq:b737m737m737n
TLSH
T1ADB7AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_609822704\CRX_INSTALL\128.png
Size 55.7MB
SHA256 de86de507d3178dea53032139b18680299a8d5f373b7b12a84e56df3ac49fba7
MD5 aef3ac6369a7e26bcf1b8eccc5eba2ee
SHA1 2f20152fa0dd1e5a7a5dfb561bcab178ebeeea75
SHA512 14643fba1ff5fc15e498609d0b0c13e45cc153e840ba20672f5e3d7d3e488b5cda887d4b9310bfaa49e071f5545bbed4a8c3493f89e7c8f339acf99f10eb8b94
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSHaoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoSDaW:b7m737m737m7370
TLSH
T1C3D7AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 fcd4caa16972bd061f0f8c90cb83f5918268042675a610eb1ebc7a8772c0d1aa
MD5 01567f22fae81363155719e1d1f9c002
SHA1 9e5b54c718983bbaafe12d23dfa55d09a7987dbf
SHA512 fe36229a55c94cd7837caff42edea58869dc6150001e6e54e2f8eacb812cd8b3ef5ee83bfbe30299e438e3f50f9e6e4620902561719c7653f01d8c30c864f636
TLSH
T1EFD0129266264523927261D10359C44A8774D1413572DB269189A9552132AD6807868F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 8.0MB
SHA256 8e7b176b690e73774c00c9122f9de0b4e764e6aae8ed336d516a3d7a5e07e1da
MD5 5102102ccbbf4aaf2df3608bb340d041
SHA1 194b2cc3f318b21355e6a95c8569b1681a7548c5
SHA512 d38a15a897a894ed3df77055fce8d3bc013e6154863444761044e3b78c322fceb664ef2e35056284578c274d7756204da16b67e18f8a0f022697f07ccdc4af96
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSHaoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoSDaI:b7l
TLSH
T17386AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/412-43-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/788-44-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/788-11-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2236-36-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2372-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2372-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4224-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4420-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4704-39-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads