lunam | bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
Size 7.4MB
Sample260826-nb2b2sch89
SHA256 bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618
MD5 5402516b7b392b032ea2f697990eab3b
SHA1 9dfa4966b44ec7b592b2a87a83d9c79037d0b9cc
SHA512 bcc0f5ddafbaf15149fa72762758b7bcc8b0ac4da123d9c007bba61458db9605dec3a39a126ca0e4da3e1ceaace4a4d97588d8016215123730342198bca234d0
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSRaoS4aoSDaoS4aoSDaoS4aoS4ay:b7+
TLSH
T16576AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 8 IoCs

resource	yara_rule
behavioral1/files/0x000f00000002441c-9.dat	family_lunam
behavioral1/files/0x0007000000024464-13.dat	family_lunam
behavioral1/files/0x00010000000237c0-47.dat	family_lunam
behavioral1/files/0x00010000000237c0-49.dat	family_lunam
behavioral1/files/0x00010000000237c0-51.dat	family_lunam
behavioral1/files/0x00010000000237c0-53.dat	family_lunam
behavioral1/files/0x00010000000237c0-55.dat	family_lunam
behavioral1/files/0x00010000000237c0-57.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
5116	avscan.exe
2644	avscan.exe
440	hosts.exe
620	hosts.exe
2632	avscan.exe
3452	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4732	WScript.exe
3368	WScript.exe
1232	WScript.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2988-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x000f00000002441c-9.dat	upx
behavioral1/files/0x0007000000024464-13.dat	upx
behavioral1/memory/2644-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2988-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2644-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2632-39-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/620-38-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3452-43-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/5116-44-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/440-45-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00010000000237c0-47.dat	upx
behavioral1/files/0x00010000000237c0-49.dat	upx
behavioral1/files/0x00010000000237c0-51.dat	upx
behavioral1/files/0x00010000000237c0-53.dat	upx
behavioral1/files/0x00010000000237c0-55.dat	upx
behavioral1/files/0x00010000000237c0-57.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
File created	\??\c:\windows\W_X_C.bat	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
File opened for modification	C:\Windows\hosts.exe	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4748	cmd.exe
256	cmd.exe
956	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
808	REG.exe
3736	REG.exe
2364	REG.exe
2144	REG.exe
4760	REG.exe
4388	REG.exe
4668	REG.exe
920	REG.exe
4128	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5116	avscan.exe
440	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2988	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
5116	avscan.exe
2644	avscan.exe
440	hosts.exe
620	hosts.exe
2632	avscan.exe
3452	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4388	2988	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe	86
PID 2988 wrote to memory of 5116	2988	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe	88
PID 5116 wrote to memory of 2644	5116	avscan.exe	89
PID 5116 wrote to memory of 956	5116	avscan.exe	90
PID 2988 wrote to memory of 4748	2988	bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe	91
PID 4748 wrote to memory of 440	4748	cmd.exe	95
PID 956 wrote to memory of 620	956	cmd.exe	96
PID 440 wrote to memory of 2632	440	hosts.exe	97
PID 4748 wrote to memory of 4732	4748	cmd.exe	98
PID 956 wrote to memory of 3368	956	cmd.exe	99
PID 440 wrote to memory of 256	440	hosts.exe	100
PID 256 wrote to memory of 3452	256	cmd.exe	102
PID 256 wrote to memory of 1232	256	cmd.exe	103
PID 5116 wrote to memory of 808	5116	avscan.exe	112
PID 440 wrote to memory of 4668	440	hosts.exe	114
PID 5116 wrote to memory of 3736	5116	avscan.exe	116
PID 440 wrote to memory of 2364	440	hosts.exe	118
PID 5116 wrote to memory of 2144	5116	avscan.exe	121
PID 440 wrote to memory of 920	440	hosts.exe	123
PID 5116 wrote to memory of 4760	5116	avscan.exe	125
PID 440 wrote to memory of 4128	440	hosts.exe	127

C:\Users\Admin\AppData\Local\Temp\bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe
"C:\Users\Admin\AppData\Local\Temp\bac697c8e424d448fed1c03801e8ac32010b0525f6b6f48dbada29395a5b9618.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:4388
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:620
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:3368
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:808
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3736
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2144
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:256
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3452
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1232
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4668
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2364
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:920
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4128
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 7.4MB
SHA256 9d356e65eb9e52b0e67505d761efb7d98d87005832caf001035b8ce8aca629ff
MD5 dc12a622672ebe3d092a9c8583df06b7
SHA1 151981a7e8844a5f5525deb3a10a3b1212c04a7d
SHA512 4a3826f425972e2619fd775e8309107d28557cedffec904e7ae3c96726cab86d84d619505541ebe2f08dd823ec810fa866ca8d4c49fa7213b28b12bcfa6b8ae1
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSRaoS4aoSDaoS4aoSDaoS4aoS4ag:b7s
TLSH
T10276AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 14.7MB
SHA256 9df2a0d6fab3768b517f612fbf27b4f90873c41e6869d86a8136f7697b2ad6fe
MD5 134a0a31b10c7418dd7994085da122c8
SHA1 26a7b3b7771ca812e13585b97b53707dac09055b
SHA512 4000dea5f0b4ea04fe3bac61d2df2a450113eae0e63bc3b52dcdc0533f39d951e4af288c47644f16cd8ff2d0fc1dc747e2c61c8bbd3a80d5297cab1fd9d7808d
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSRaoS4aoSDaoS4aoSDaoS4aoS4a/:b7L7T
TLSH
T175F6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 22.1MB
SHA256 cb375f9d09f767831ac556b161feea8fcaae27e73663a7036daebed41c4961dc
MD5 383a75ddd841eea93aeb9f4b7f01ee7e
SHA1 2296f8804ed73a3739bddd0906bc19e462d10d1f
SHA512 b7421f9f546498c39c964e05e832ad73298b885bb2055dce900cfab945666e482284635e47cd05893034dbbcfa92d06b4220b64a80c2f81d154b59281c44a7c6
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSRaoS4aoSDaoS4aoSDaoS4aoS4a3:b7A7L7E
TLSH
T14D37AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 29.5MB
SHA256 8061d58a51b6c781e8038ef14cbf41312ed0c5b3bc1ff8e752ac4be6e1d340b9
MD5 ba3c80f7d1fb9dfdce989f0c0005c6f9
SHA1 73c8b39e1d6d3ec68e7d647126f3c984b63abc51
SHA512 af2aba7148967c60da8a7072b2b815ac5bf0998b3032078bc8531ca2f5df458fe87211fd72c1946234b414d718aa74860e66ce1dfc326efceb7ce69b96e7d8ae
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSRaoS4aoSDaoS4aoSDaoS4aoS4a6:b7L7A7L7J
TLSH
T19367AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 36.9MB
SHA256 c6241d56c381ebdb42f27f57bf8146395284f8b9974f517bcec6285aa6781329
MD5 513a60c172ab01f39468c74c35816967
SHA1 cdc56537083e0c615918a2adc2d92e331281a9d8
SHA512 75416eff14831a1f10b2f40d21fbcd64ea9953767fa6c86338d180c0a1906aa2beddad3562d5344806808cb747a5e199f3fb082db6d0674a053bbb50c6e06529
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSRaoS4aoSDaoS4aoSDaoS4aoS4aM:b7A7L7A7L7i
TLSH
T1D887AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 44.2MB
SHA256 bbcf3a21c4f76a860af3df1c1973ddb045246123753606bd0ac3ce4d1b768e27
MD5 6aceaabfd395d671889b08f4105915c3
SHA1 f163d3a0eb57671bd80a7ef847a956ccf56dd612
SHA512 5846c6af4382720534945406f8f1f14ad5093c02a479b4481ca93ef8b7d0cfc6fe09c7333db58097828d7dd6d1287d08790ac8793d73b01bc57686093229e50b
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSRaoS4aoSDaoS4aoSDaoS4aoS4aH:b7L7A7L7A7L7Z
TLSH
T1D6A7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 51.6MB
SHA256 e42069cfe43ef5a869acd7bfb2da5db758262cb0bf0d4659bf3c43dd6854e1c3
MD5 59213a06d7cbc0f16010735e88f007c7
SHA1 9fae0bd45156a4c9a25f0c2cd6ada80e14d59340
SHA512 d6b15ddb889e47db274a1468f8c2a47858022cebf77c52b28444acb280493698350a30fe46c7fd88a7e6a3985bf320eca6eeaffa87e6784674490f4477d4e819
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSRaoS4aoSDaoS4aoSDaoS4aoS4av:b7A7L7A7L7A7L7+
TLSH
T11BC7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 6e1f1a5cf696df3d046d9f41dc8d79dbe266b6c8d84cb4e6527088dc5e2f3029
MD5 54e6b9b4bf49d02d6de6be7f3dadb921
SHA1 8a7634f87f967a66889d08f386c07f15f0ac4863
SHA512 30363aa7586f6142473bcc467cd4a0cfc8ccbca79c647cb23065499f40471f08451456e25489fa8b03c999b3d4480b3753d3fc9ff64c5651a7feec308d6e6273
TLSH
T14FD0C0D1662A4033C27671D2131AC0458774D0403132DB2196CDAC003133FC3407C2CF
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 7.4MB
SHA256 659ee9a94d2ec3b1c36a995411e27d0a8309d2f84d8f657820e8d5124271bad0
MD5 f0ae8d0a6fbd2c4e50bb71c20067b09a
SHA1 87dd4c8248eba060061016a8e87e358060b10c44
SHA512 e4381b2da8a67f304a3bf4a4315ac02e8825cfb94c2015559d5c6b05c5ffc75ee9248e01a38ed7d90641479e3c7afd1d5e0b9eebcf9586191c14cde50eb37e46
SSDEEP 12288:b7IoS/aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSRaoS4aoSDaoS4aoSDaoS4aoS4aQ:b70
TLSH
T19876AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/620-38-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2632-39-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2644-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2644-16-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2988-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2988-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3452-43-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5116-44-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads