Overview

overview

7

Static

static

3

LuaTools-w...up.exe

windows10-2004-x64

7

LuaTools-w...up.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    47s
  • max time network
    50s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/08/2026, 15:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LuaTools-win-Setup.exe
  • Size 11.2MB
  • Sample260825-swt6pavcjf
  • SHA256 f14d9071ec8ad59f2f292ae957e54e4dc76e8c0d3a4cd750919b44b1c6e805f7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
      "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe" --veloapp-install 1.2.8
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5712
    • C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
      "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5812

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CommunityToolkit.Mvvm.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\CommunityToolkit.Mvvm.dll
        • Size 143KB
        • SHA256 19b2144fed9600d58a742a5a4a5fd7b10d4d0d2c2e79f5d8019307cf5657044f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LuaTools.deps.json
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.deps.json
        • Size 36KB
        • SHA256 ea76bd607bfeb17d1f928ccb752f2c01076e12fb13b3d82609e20c2eaf3cc765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LuaTools.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.dll
        • Size 1.1MB
        • SHA256 61d4a6e12c84fc99753d360436e06ba07037ef62a309d54a15087eda7e824d3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LuaTools.exe
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
        • Size 254KB
        • SHA256 31817ddfeab38f39a28554dc11b5b4524726a929d1e07b887b241c7c593f2dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LuaTools.runtimeconfig.json
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.runtimeconfig.json
        • Size 496B
        • SHA256 b7ab6a0ad18cf1280ad75c8e6d0df62d06c84d62dc69351e49c04afd3e218eb2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft.Extensions.Configuration.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Abstractions.dll
        • Size 26KB
        • SHA256 3700bf75d75ceef47ebd6df7df9bafb9f7b7dcf22fc537f227db72ccf74c476d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.Binder.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Binder.dll
        • Size 41KB
        • SHA256 efc13893ebfa02cc7e49ac13cfef68517c4441a33210d67956e7488b8e6b277d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.CommandLine.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.CommandLine.dll
        • Size 23KB
        • SHA256 a1c8c9728b0dc64dcd975f82d013a1b7bc0c0133e46a94f29044f16cad6072b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.EnvironmentVariables.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.EnvironmentVariables.dll
        • Size 21KB
        • SHA256 bbb26aacd4ba67351d3740106bbcc5544827d98d91b48109362988147ae7963e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.FileExtensions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.FileExtensions.dll
        • Size 26KB
        • SHA256 1830c601c1b155c54fbd3a6844453dae87af14eafe763942939d06905035130f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.Json.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Json.dll
        • Size 25KB
        • SHA256 e106f8bc13df7168294b95a6cdbceaba47b8eb7e562940eb4ef038db6fb1f2d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.UserSecrets.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.UserSecrets.dll
        • Size 24KB
        • SHA256 a310bcdd868dafc0efce5b03a68cd7af5d4fa0d06509ed4b5c51ddc1758e9791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.dll
        • Size 42KB
        • SHA256 7a883c57d00808ca9b5d11bfaa2c5d21f714ed7560e781d7313d65b09b88b6c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.DependencyInjection.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.Abstractions.dll
        • Size 63KB
        • SHA256 c2a34d5259e6d6c0af43d9b926454105e80e7657dfed901d845100db254de89b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.DependencyInjection.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.dll
        • Size 92KB
        • SHA256 4d7fb7b6a171047984a8316b1a355c65e33350c343f4e0ea2f1233be457eb7e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Diagnostics.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.Abstractions.dll
        • Size 29KB
        • SHA256 0a9e51f2d4861367908fa058da82b4a0deb6f85f6ba11d3c90b01c848b1fcdac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Diagnostics.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.dll
        • Size 34KB
        • SHA256 0842e20c25240aca53809e005776eb88f53a61128c632c4c6fa8685b9f66c4b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.FileProviders.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Abstractions.dll
        • Size 21KB
        • SHA256 02f38beb848fa01fcc55f0cf3982ca01e1a5aeba95933131a197ef602a130763
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.FileProviders.Physical.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Physical.dll
        • Size 43KB
        • SHA256 e6073f96262a3c468c5024564fa02df0f36234242b392c8b658b81bb1b9d968a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.FileSystemGlobbing.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileSystemGlobbing.dll
        • Size 45KB
        • SHA256 965a5347b125d232361dd08027ab263ed1d042b0240ec4a4f29b7a0bfd74bb28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Hosting.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.Abstractions.dll
        • Size 51KB
        • SHA256 57c2528e1f2b3872976661686af9bcbd0612de7ee6b4ef4cfe92b746b27aa1b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Hosting.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.dll
        • Size 69KB
        • SHA256 ca135e4b48abc2effdb6fdf085837966c35f3a8a305744429009dde946d633c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Abstractions.dll
        • Size 64KB
        • SHA256 4ad4a3b2bed7f5f293f83cc2c46169b93a9863b89428f693a4f17863704f47aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.Configuration.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Configuration.dll
        • Size 26KB
        • SHA256 ed0a70f939dc8779ee85802e926f138e284828ac14d44831ca68fdcd14450b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.Console.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Console.dll
        • Size 73KB
        • SHA256 84ca5528a45074f18ae4234956de55d238a65be39f914f88293732dfd3889a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.Debug.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Debug.dll
        • Size 19KB
        • SHA256 ec47584ec7344dbe9b3ec5740cf493a8dbf346e467d6855e24be33555db11983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.EventLog.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventLog.dll
        • Size 24KB
        • SHA256 f70b8392447817a4d44acd5785e0bc029a2844d5445e05b98d95b237443339db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.EventSource.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventSource.dll
        • Size 33KB
        • SHA256 665d5316f601ed6dd9daa6d7534610ca3a7aa40e4d117c079ffb118ea2179b2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.dll
        • Size 49KB
        • SHA256 48bd4a0d323e0ae85fa0469779bb13e92c4600b0a49dad6bcb891047c5e17caf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Options.ConfigurationExtensions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.ConfigurationExtensions.dll
        • Size 21KB
        • SHA256 3057894505e37852ac77ba70007a6b075980be4da9c3afcdb7a37e62750bda1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Options.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.dll
        • Size 62KB
        • SHA256 4e767f3c0bf37199a83b8697fc9431d907fe39b5f2763f83381865c89ea6545d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Primitives.dll
        • Size 42KB
        • SHA256 b5e8630df19605fec639873b86bdff6f9d424db88d181bb36a0bd641558c18ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.DiagnosticSource.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Diagnostics.DiagnosticSource.dll
        • Size 187KB
        • SHA256 d28e247dc8b6af02968b65fe6aae25c2ee689d2007268375d63347aeac0bea6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.IO.Pipelines.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.IO.Pipelines.dll
        • Size 75KB
        • SHA256 a3c80d0bb52e0f5afc73638cfe5dc25e3470e5fdc0311745aebc8a4d4cfcba35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.ProtectedData.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Security.Cryptography.ProtectedData.dll
        • Size 37KB
        • SHA256 ce7f4b80de12f227ac637915470c5b6b6a5d716456835caaa0b1600c3cbdcb6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Encodings.Web.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Encodings.Web.dll
        • Size 64KB
        • SHA256 8839f3cdeabd22f5952c4673367ea41c921aeb0ea26e18fb23906e2cac08298b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Json.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Json.dll
        • Size 660KB
        • SHA256 bb53577c13ab01f397585e4bb642a1a89f1af91b70eb385c7c05b82b9b912605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Velopack.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Velopack.dll
        • Size 261KB
        • SHA256 b35698f5f66978d7bfd0ab12a2a2899f05912d9a1890d5e64c2dce9bacf2662f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VirtualizingWrapPanel.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\VirtualizingWrapPanel.dll
        • Size 55KB
        • SHA256 8b59a3fbe3a041264535df8f0fcf0171ea633e57a9084882b9fe6c220181b3fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wpf.Ui.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.Abstractions.dll
        • Size 7KB
        • SHA256 f504e30e37a74936ac14f14de4ac43c291cb3964eda71cdcdd61f27cf15cb9cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wpf.Ui.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.dll
        • Size 6.3MB
        • SHA256 3466432f74d1d1224a55f71b8dec7b2913039e01ee32b7304fd9668fb76b797d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.EventLog.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\runtimes\win\lib\net8.0\System.Diagnostics.EventLog.dll
        • Size 171KB
        • SHA256 59fb8f95e34b4dbc41422e801ca9456da5ab70508d773e42e2ce1c60de38a88f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sq.version
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\sq.version
        • Size 534B
        • SHA256 8b90c15a0e958784082da5c72fc31f581cc058e0a186a5d1fb07e1d55b42e1a3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LuaTools-1.2.8-full.nupkg
        • Path C:\Users\Admin\AppData\Local\LuaTools\packages\LuaTools-1.2.8-full.nupkg
        • Size 6.8MB
        • SHA256 f8f0c2f374eaee48f07a1e42cd34fb24b0c58f1edd15a7ba672c17cc25c566fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        velopack_LuaTools.log
        • Path C:\Users\Admin\AppData\Local\velopack\velopack_LuaTools.log
        • Size 1KB
        • SHA256 bb67ddcbe17386b3e14d5d9449c1f7328e4de7c52ba33e0025f121f21d59cead
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/5812-137-0x0000027E41BC0000-0x0000027E41DA4000-memory.dmp
        Download

        memory/5812-135-0x0000027E41BC0000-0x0000027E41DA4000-memory.dmp
        Download

        memory/5812-139-0x0000027E41BC0000-0x0000027E41DA4000-memory.dmp
        Download

        memory/5812-140-0x0000027E41BC0000-0x0000027E41DA4000-memory.dmp
        Download