lunam | 59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 08:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
Size 8.1MB
Sample260826-kxfexsce48
SHA256 59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6
MD5 b61d25dba03441a138a4b43d7eb7409f
SHA1 6b27a527ec8809e33c71010ba03709a27da87bb1
SHA512 b249f90ed1cc05be48786f4bf6b13135b02499688f9008f2fb22dea38a18e8598b00440dad85d04079cdf8aa9a56fd48a8eeb5418674d727aadf136ea336ca7c
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoS4aoS4ar:b70
TLSH
T1E686AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 8 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024434-10.dat	family_lunam
behavioral1/files/0x0007000000024435-13.dat	family_lunam
behavioral1/files/0x00010000000237c0-48.dat	family_lunam
behavioral1/files/0x00010000000237c0-50.dat	family_lunam
behavioral1/files/0x00010000000237c0-52.dat	family_lunam
behavioral1/files/0x00010000000237c0-54.dat	family_lunam
behavioral1/files/0x00010000000237c0-56.dat	family_lunam
behavioral1/files/0x00010000000237c0-58.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
1504	avscan.exe
4128	avscan.exe
3920	hosts.exe
4036	hosts.exe
1188	avscan.exe
312	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
2288	WScript.exe
2824	WScript.exe
1016	WScript.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4336-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x0008000000024434-10.dat	upx
behavioral1/files/0x0007000000024435-13.dat	upx
behavioral1/memory/4128-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4128-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4336-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3920-38-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1188-40-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/312-44-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1504-45-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4036-46-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00010000000237c0-48.dat	upx
behavioral1/files/0x00010000000237c0-50.dat	upx
behavioral1/files/0x00010000000237c0-52.dat	upx
behavioral1/files/0x00010000000237c0-54.dat	upx
behavioral1/files/0x00010000000237c0-56.dat	upx
behavioral1/files/0x00010000000237c0-58.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
File created	\??\c:\windows\W_X_C.bat	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
File opened for modification	C:\Windows\hosts.exe	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
556	cmd.exe
1712	cmd.exe
4456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
624	REG.exe
4228	REG.exe
832	REG.exe
1128	REG.exe
3148	REG.exe
4040	REG.exe
4512	REG.exe
4372	REG.exe
2932	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1504	avscan.exe
4036	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4336	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
1504	avscan.exe
4128	avscan.exe
4036	hosts.exe
3920	hosts.exe
1188	avscan.exe
312	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 624	4336	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe	85
PID 4336 wrote to memory of 1504	4336	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe	87
PID 1504 wrote to memory of 4128	1504	avscan.exe	88
PID 1504 wrote to memory of 556	1504	avscan.exe	89
PID 4336 wrote to memory of 1712	4336	59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe	90
PID 556 wrote to memory of 3920	556	cmd.exe	93
PID 1712 wrote to memory of 4036	1712	cmd.exe	94
PID 4036 wrote to memory of 1188	4036	hosts.exe	95
PID 4036 wrote to memory of 4456	4036	hosts.exe	96
PID 556 wrote to memory of 2288	556	cmd.exe	98
PID 1712 wrote to memory of 2824	1712	cmd.exe	99
PID 4456 wrote to memory of 312	4456	cmd.exe	101
PID 4456 wrote to memory of 1016	4456	cmd.exe	102
PID 1504 wrote to memory of 4512	1504	avscan.exe	106
PID 4036 wrote to memory of 4228	4036	hosts.exe	109
PID 1504 wrote to memory of 832	1504	avscan.exe	117
PID 4036 wrote to memory of 1128	4036	hosts.exe	119
PID 1504 wrote to memory of 3148	1504	avscan.exe	121
PID 4036 wrote to memory of 4372	4036	hosts.exe	123
PID 1504 wrote to memory of 4040	1504	avscan.exe	125
PID 4036 wrote to memory of 2932	4036	hosts.exe	127

C:\Users\Admin\AppData\Local\Temp\59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe
"C:\Users\Admin\AppData\Local\Temp\59bb163bdf0b54c63db725c30b0e307781a70d4539e4c8b6e845d485d4f154b6.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:624
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3920
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:2288
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4512
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:832
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3148
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:312
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1016
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4228
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1128
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4372
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2932
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 8.1MB
SHA256 ebc7f918f7b75c3076bf3e75eaa921ad96f293e58312e06491b1fbc8f7061ab8
MD5 b44d2709f1120f7527157d7c3641a953
SHA1 f6ffbb7925e2fa91d335f62ca457058a1672334e
SHA512 ae7190ee146eb87722a6d4fac0c13323c6218ad4c9ccad294f3df9b1862617c9d87bdc00af8ec0cdb2608a7745022bc94d9630b0c3f44129765f106a5fa4df1e
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoS4aoS4aU:b7/
TLSH
T12C86AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 16.2MB
SHA256 ef935bafa2d45292277a186ad8c50b62d66b89948414ddf32e0347764e7b19ad
MD5 3e1b848369d3f90e34b2485217456a0c
SHA1 2149be76799e00c2f2c8ae5d1d8945ffa77e9d56
SHA512 039e36b3a9765491e658ec928a39f7aded06f86d5a814b5e7ca130ee9e2b4b8cf004a565e3a9366b20d30eab6edbd66e1458b346f40da8bacab6bfec22de755b
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoS4aoS4al:b7g7f
TLSH
T1D107AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 24.3MB
SHA256 a600b3cc8fa89a8816ca666185fbd188f54d329e2afcba8e4ca1f6e530f9d426
MD5 ebcdba66b280451a904e2fc2a3c83f72
SHA1 0d94ad5402010d3f3d8118d0bcee0a32fdc5bd9e
SHA512 fe277dfad46daa1981a85934cb5dd2b87a8f6326a7c65994bef84515f858c6c8483d2f9d0d778eb468ea0b9aa31a8a5dceed5d98d852b5b7ba2d3b705c2e2cb2
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoS4aoS4a1:b7k7g74
TLSH
T1A047AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 32.4MB
SHA256 099e64babf787258c9ca04e3554e9dc135838d2f7d3b2a37666e17d193acb5fd
MD5 da22e6f750765b4552c9a91a5efde237
SHA1 1732042ef37ad2ce6c2edcc50d036662ca90e351
SHA512 21eaaa94ad71edc9776e734a92597a1e193855315a7d2f700a4a06a24e87e250f62a242dee103083abee93ed57e3bff50abe05d96847c60aa896af36a200c3de
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoS4aoS4ad:b7g7k7g7l
TLSH
T1F177AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 40.5MB
SHA256 99b0ae757e0a947c83e51e888b013073295aeb08f35026d71820a06819e5d8ae
MD5 0b2edf2d8d961a86fcb92fd91e8d0968
SHA1 80cbd0cf6cd611af2890ad7c44da2448f71b61cf
SHA512 85199ee548cc315cc4d9262e05a2119aafe319706be8a8032064cdf83d0828e42e55c8a3e0ac9585ad6d74ec3d58118d8f2da44cb8cc5cca8fdabac7dc2a0a72
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoS4aoS4ax:b7k7g7k7g7m
TLSH
T18E97AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 48.6MB
SHA256 fc5d9fa5a5052428feff22bd1962c6cc872ff9f3b70fb584d716f3e3f4384de7
MD5 38e3dc3a302e9f0ae95cd4ee0970e323
SHA1 e1b0200117bd110dcdec4c01f9e09d8c9a6d1926
SHA512 6c62a0d9531f337a3e74a029eaeb5f76958c7b51cad3fc46ec858b2aeea85033067521d7e5545361d1598d9ba8bcfbbffe583afacf11e69b75556e301b678536
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoS4aoS4a/:b7g7k7g7k7g7t
TLSH
T1E3B7AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 56.7MB
SHA256 735c85d916adb539f18e0f46387b3639ba0a94a2b8c453e6d70c53838801a42d
MD5 8cde2cba0bac728c0c1556506a4ef1b6
SHA1 647b1c6b75bac685bae3349fa2b6e5ddf68ebd05
SHA512 4cf4b83e8d8a9f502b563380a63f6942fc0c8b5bf471679289b3ad64d86a922ffcbe411d00415cf83c66cabb8a2ae9235694e11dbd1bb9f1bd81b38cec765d1c
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoS4aoS4ar:b7k7g7k7g7k7g7q
TLSH
T128D7AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 6e1f1a5cf696df3d046d9f41dc8d79dbe266b6c8d84cb4e6527088dc5e2f3029
MD5 54e6b9b4bf49d02d6de6be7f3dadb921
SHA1 8a7634f87f967a66889d08f386c07f15f0ac4863
SHA512 30363aa7586f6142473bcc467cd4a0cfc8ccbca79c647cb23065499f40471f08451456e25489fa8b03c999b3d4480b3753d3fc9ff64c5651a7feec308d6e6273
TLSH
T14FD0C0D1662A4033C27671D2131AC0458774D0403132DB2196CDAC003133FC3407C2CF
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 8.1MB
SHA256 7ce0fdfa4c303cc91470602308ab8af408baddaabd299d55d06f161a35bc2231
MD5 1a8b38e3352461652ce72f6787a91a93
SHA1 db8cb5f30f1d5e84f4c197c57c854259d448b4ac
SHA512 e5d0920e24e857446bcf65e43daf882a1bffa9139b721d9bc607b563c76744f3d7704c2a351f4bb3bad5a3a28e2099f51750152c49f6a214638bf107060edc23
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSuaoSDaoS4aoSDaoS4aoS4aoS4aL:b7M
TLSH
T18D86AF537757A50BF02A8A390A11879D5396FE328E027897B2D03E3B3D331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/312-44-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1188-40-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1504-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3920-38-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4036-46-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4128-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4128-16-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4336-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4336-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads