lumma | hxxps://gofile[.]io/d/Wn7CNa

Analysis

max time kernel
38s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/Wn7CNa

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://composepayyersellew.shop/api

https://publicitycharetew.shop/api

https://computerexcudesp.shop/api

https://leafcalfconflcitw.shop/api

https://injurypiggyoewirog.shop/api

https://bargainnygroandjwk.shop/api

https://disappointcredisotw.shop/api

https://doughtdrillyksow.shop/api

https://facilitycoursedw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe

pid process

5172 $RTQUMAP.exe
5352 $RTQUMAP.exe
5440 $RTQUMAP.exe
5508 $RTQUMAP.exe
5580 $RTQUMAP.exe
5644 $RTQUMAP.exe
6016 $RTQUMAP.exe
5244 $RTQUMAP.exe

pid	process
5172	$RTQUMAP.exe
5352	$RTQUMAP.exe
5440	$RTQUMAP.exe
5508	$RTQUMAP.exe
5580	$RTQUMAP.exe
5644	$RTQUMAP.exe
6016	$RTQUMAP.exe
5244	$RTQUMAP.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe$RTQUMAP.exe

description	pid	process	target process
PID 5172 set thread context of 5272	5172	$RTQUMAP.exe	RegAsm.exe
PID 5352 set thread context of 5380	5352	$RTQUMAP.exe	RegAsm.exe
PID 5440 set thread context of 5476	5440	$RTQUMAP.exe	RegAsm.exe
PID 5508 set thread context of 5544	5508	$RTQUMAP.exe	RegAsm.exe
PID 5580 set thread context of 5612	5580	$RTQUMAP.exe	RegAsm.exe
PID 5644 set thread context of 5672	5644	$RTQUMAP.exe	RegAsm.exe
PID 6016 set thread context of 6052	6016	$RTQUMAP.exe	RegAsm.exe
PID 5244 set thread context of 5256	5244	$RTQUMAP.exe	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 424890.crdownload:SmartScreen msedge.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

2384 msedge.exe
2384 msedge.exe
1948 msedge.exe
1948 msedge.exe
2700 identity_helper.exe
2700 identity_helper.exe
3200 msedge.exe
3200 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1948 msedge.exe
1948 msedge.exe
1948 msedge.exe
1948 msedge.exe
1948 msedge.exe
1948 msedge.exe
1948 msedge.exe
1948 msedge.exe
1948 msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 424890.crdownload:SmartScreen	msedge.exe

pid	process
2384	msedge.exe
2384	msedge.exe
1948	msedge.exe
1948	msedge.exe
2700	identity_helper.exe
2700	identity_helper.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1948 wrote to memory of 544	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 544	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 5064	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2384	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2384	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4908	1948	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/Wn7CNa
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef34646f8,0x7ffef3464708,0x7ffef3464718
2⤵
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
2⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
2⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
2⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
2⤵
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
2⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
2⤵
PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5500 /prefetch:8
2⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5972 /prefetch:8
2⤵
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3200

C:\Users\Admin\Downloads\$RTQUMAP.exe
"C:\Users\Admin\Downloads\$RTQUMAP.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5272

C:\Users\Admin\Downloads\$RTQUMAP.exe
"C:\Users\Admin\Downloads\$RTQUMAP.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5380

C:\Users\Admin\Downloads\$RTQUMAP.exe
"C:\Users\Admin\Downloads\$RTQUMAP.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5476

C:\Users\Admin\Downloads\$RTQUMAP.exe
"C:\Users\Admin\Downloads\$RTQUMAP.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5544

C:\Users\Admin\Downloads\$RTQUMAP.exe
"C:\Users\Admin\Downloads\$RTQUMAP.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5612

C:\Users\Admin\Downloads\$RTQUMAP.exe
"C:\Users\Admin\Downloads\$RTQUMAP.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
2⤵
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
2⤵
PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
2⤵
PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12027925020337053091,15949235964818178523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
2⤵
PID:6096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5768

C:\Users\Admin\Downloads\$RTQUMAP.exe
"C:\Users\Admin\Downloads\$RTQUMAP.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:6044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:6052

C:\Users\Admin\Downloads\$RTQUMAP.exe
"C:\Users\Admin\Downloads\$RTQUMAP.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:5256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
c6ffd90144fed2513ec63f93dd9cf06e

SHA1
8de3454069f7f480f8c11a2e5aaaeecae6ae675b

SHA256
5ea3cb5d49b6e0661a38385bcc8ea0e05ec4772d1ff09dfb3308d75a39f75704

SHA512
9eaa1441e0652e7a5ef2186f7492c610a01378847dfa5f4155ce384eeeb46890ce240d44f2cdc715595da9cb6e1ac8a6fae622c4d9217b39c70a483bce873754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a8ab7bf8085d5c2989224ca84a432e17

SHA1
3992ee20c89cf917d973f311307fd15c49426a95

SHA256
165859efc0e54cbf5beb11caf51ef805ec963ffa00b8ec4619ffdbcbde061bd0

SHA512
17de1cb3a27365fa8891c58760bfe19afb6ceca543901d1d4037d204b21651e33c8256f6adc88912c950fd97cb8955f515e112bb532988ceaa39687136402a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b86e22ac65b80673d4310db00e73b3cb

SHA1
9739be2faf312ae885010da5d26469d76de482bd

SHA256
4683df9733afae97de30d990a520e4055406895e6e04a75fff5a5e02a9ead164

SHA512
efd9e75aed25a7c8f5e8627760633204892bf57ec2aa176eb35aaa9b9a614fe41a0204ce4ef79ea1ebf59aca840f597b02ae288481bb6f421939641e613dd633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
1fdaa5585ae0507b6a97ce0c4ba5c53c

SHA1
e512aab7839f494d0211a1429e9816a7b6847fef

SHA256
34587ad394c099865610a07b5df85597547fd4793d720067c97f1e4949a884db

SHA512
cd7664dadc286d5df2add9197bad31e6431f1437ead1ab9e533ff27ee13540642c7ba832e469d07bc2a19d9d2ca7832ad7e630ad3b7b9b8b0e5fcbf30944956f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
127daccdcd5fcb51a5a06f4e7e55f8b8

SHA1
02e75c9f07415b2d0cc2a21b88ede0a7e71497de

SHA256
eb904c29dd39282a17a3fc716450fe91bf2ab6a6ca4fe63393987e5ce293ef43

SHA512
9adcb14cc0a1b28a47dd0610363369c69c45ea263d572b95b7904164fbaace09addfbd53c57cb3fc5975a32dec1555274449ec82f24618252acd26bc87117993

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 424890.crdownload
Filesize
598KB

MD5
47c2be5511f85eea87d60087a2295101

SHA1
688a4b4e3bc01bee9e77d8520cf45743573f46a4

SHA256
b2f49f0484068d893545562b47fdb527299dce02c70fe7c99c1aec82310c9953

SHA512
bbe2b4706a3431bb373d88e0548fa92e72b2cbbde86fc0c3f2523fe2492ac3f4b9697c1f8bad27e32595181a4fa7cb381bbe11e9a456903c725870cfaf1fa65c

Download Submit
\??\pipe\LOCAL\crashpad_1948_XBSRIBPLZJKQCCAB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5272-106-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/5272-107-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download