lunam | 7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
Size 8.5MB
Sample260825-seqryahf34
SHA256 7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad
MD5 7e65f1234f9307492752bfb399c208c3
SHA1 a01a0cfd99781dcc3899306db4bcbf49bc0b6955
SHA512 450792d2c7bff40d94a4b3206eda22d95814177c39d54a9c05a51745e356972b7650fad1cb57ec7e08c68200790f2076c1687c4d7637a16853f072a99c114654
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSTaoS4aoSDaoSOaoS4aoSDaoS4aoSDaoS4aoSDaK:b76
TLSH
T1B996AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002457b-9.dat	family_lunam
behavioral1/files/0x000700000002457c-13.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RPHJNYLJ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RPHJNYLJ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RPHJNYLJ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
4916	avscan.exe
2976	avscan.exe
3580	hosts.exe
2100	hosts.exe
3304	avscan.exe
3532	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
1684	WScript.exe
2864	WScript.exe
1392	WScript.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5040-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x000700000002457b-9.dat	upx
behavioral1/files/0x000700000002457c-13.dat	upx
behavioral1/memory/2976-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2976-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/5040-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2100-37-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3304-40-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4916-42-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3532-45-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3580-46-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
File created	\??\c:\windows\W_X_C.bat	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
File opened for modification	C:\Windows\hosts.exe	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2008	cmd.exe
3848	cmd.exe
4540	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4228	REG.exe
3300	REG.exe
3448	REG.exe
3172	REG.exe
2804	REG.exe
3508	REG.exe
2292	REG.exe
4476	REG.exe
3960	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4916	avscan.exe
3580	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5040	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
4916	avscan.exe
2976	avscan.exe
3580	hosts.exe
2100	hosts.exe
3304	avscan.exe
3532	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2292	5040	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe	85
PID 5040 wrote to memory of 4916	5040	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe	87
PID 4916 wrote to memory of 2976	4916	avscan.exe	88
PID 4916 wrote to memory of 2008	4916	avscan.exe	89
PID 5040 wrote to memory of 3848	5040	7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe	90
PID 3848 wrote to memory of 3580	3848	cmd.exe	93
PID 2008 wrote to memory of 2100	2008	cmd.exe	94
PID 3580 wrote to memory of 3304	3580	hosts.exe	96
PID 3848 wrote to memory of 2864	3848	cmd.exe	98
PID 2008 wrote to memory of 1392	2008	cmd.exe	97
PID 3580 wrote to memory of 4540	3580	hosts.exe	99
PID 4540 wrote to memory of 3532	4540	cmd.exe	102
PID 4540 wrote to memory of 1684	4540	cmd.exe	103
PID 4916 wrote to memory of 4228	4916	avscan.exe	113
PID 3580 wrote to memory of 3300	3580	hosts.exe	117
PID 4916 wrote to memory of 4476	4916	avscan.exe	125
PID 3580 wrote to memory of 3960	3580	hosts.exe	128
PID 4916 wrote to memory of 3448	4916	avscan.exe	131
PID 3580 wrote to memory of 3172	3580	hosts.exe	133
PID 4916 wrote to memory of 2804	4916	avscan.exe	135
PID 3580 wrote to memory of 3508	3580	hosts.exe	140

C:\Users\Admin\AppData\Local\Temp\7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe
"C:\Users\Admin\AppData\Local\Temp\7572674d9eb40093a7b6c09b6fc597ac76544f2a33b91af1c16f607a1da6b0ad.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2292
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2100
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:1392
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4228
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4476
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3448
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4540
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3532
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1684
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3300
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3960
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3172
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3508
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 8.5MB
SHA256 28570454ea7cfc68e082d2ebabbbc8dfd10c3add8b25932f5ab566f69374b9c3
MD5 fbd54a82f190ad03d9ed754365b4f26b
SHA1 075b394fee97ba4f2c714d2c4a4181f67d573d6c
SHA512 536c257d9b8a5ac996a1c2947fadd53318d14c9d050b7c1798cfde063c2352656ce37b7ddd49f46fcb75f6fb2cd47de23ca7b123906d78b2d04bf09bd48fe739
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSTaoS4aoSDaoSOaoS4aoSDaoS4aoSDaoS4aoSDa0:b7E
TLSH
T1A296AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 179ba010908d33b071f724cf63498ae72f0ba81c24ac9e597481ddaaeb777053
MD5 e8ce93dc3403e787224a08b907dabfed
SHA1 baa3ff72f84d74ad3ba65b407665108bac09d33e
SHA512 c94bc94e77b614079d660e5a5c3a5a55cc1a02656520309dde631a4352cfa6c585ac30cc62d608396a04d9517606bdeec830af6e2cb84681a6dcb06578ef98ce
TLSH
T1F6D012D2662685239276A1D103199445477491413572DF25A189A9556172AB7407828F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 8.5MB
SHA256 101d81e52cf8d61ff98281253d0708b5069629733214545c0478e71b7198e919
MD5 e258907c5491b41eeb6ba4e4eec76f9d
SHA1 56cbb3ea0ec0e7934a21e04d9d67e6ab4c265595
SHA512 9588b383aa3bc4fb21872b06dd4e98bad0b703288b19eeafa480f1469f704cdf199adf353ac65847dffc725962173a2336bffe3b97370f8e4b0ab1c79232b7c4
SSDEEP 12288:b7IoSkaoS4aoSDaoS4aoSDaoSTaoS4aoSDaoSOaoS4aoSDaoS4aoSDaoS4aoSDav:b7f
TLSH
T1BD96AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2100-37-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2976-16-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2976-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3304-40-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3532-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3580-46-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4916-42-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5040-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5040-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads