lumma | 4da4f79df8c557f7aff954656c0f57de9aa4e612689d416121c9040202e1535c

Analysis

max time kernel
119s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cheat.zip
Size

50.5MB
MD5

d52276dc06c94488225745c77164b851
SHA1

1daa41d4a530495e3330cdb02c9c68aecf4851ea
SHA256

4da4f79df8c557f7aff954656c0f57de9aa4e612689d416121c9040202e1535c
SHA512

3475dd3c4e91811d9549d0805756ce7db6df825c0a2e01999f8d39266cc2fc64ab1d8ce573df456315ee05c17111d1f41dabc99ed8c86bac6fca4b1e71fadde6
SSDEEP

1572864:9UgurkcyRRZpcfN22PSXOX+rMSaPWR4yPP1FIrtkYa:9n8kce3cfN2GSXqPWyiUZkB

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://bitchsafettyudjwu.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 14 IoCs

Processes:

CheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exe

description	pid	process	target process
PID 4124 set thread context of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 2100 set thread context of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 5092 set thread context of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 2928 set thread context of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 1592 set thread context of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 3784 set thread context of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 4528 set thread context of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 1780 set thread context of 1288	1780	CheatInjector.exe	RegAsm.exe
PID 4300 set thread context of 512	4300	CheatInjector.exe	RegAsm.exe
PID 4940 set thread context of 4324	4940	CheatInjector.exe	RegAsm.exe
PID 3232 set thread context of 4244	3232	CheatInjector.exe	RegAsm.exe
PID 3852 set thread context of 2508	3852	CheatInjector.exe	RegAsm.exe
PID 2388 set thread context of 3116	2388	CheatInjector.exe	RegAsm.exe
PID 2196 set thread context of 924	2196	CheatInjector.exe	RegAsm.exe

Program crash 14 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4956	4124	WerFault.exe	CheatInjector.exe
2592	2100	WerFault.exe	CheatInjector.exe
3396	5092	WerFault.exe	CheatInjector.exe
3676	2928	WerFault.exe	CheatInjector.exe
4124	1592	WerFault.exe	CheatInjector.exe
4284	3784	WerFault.exe	CheatInjector.exe
1176	4528	WerFault.exe	CheatInjector.exe
748	1780	WerFault.exe	CheatInjector.exe
3800	4300	WerFault.exe	CheatInjector.exe
1008	4940	WerFault.exe	CheatInjector.exe
4820	3232	WerFault.exe	CheatInjector.exe
3120	3852	WerFault.exe	CheatInjector.exe
748	2388	WerFault.exe	CheatInjector.exe
1056	2196	WerFault.exe	CheatInjector.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

taskmgr.exe

pid	process
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

taskmgr.exe

description pid process

Token: SeDebugPrivilege 848 taskmgr.exe
Token: SeSystemProfilePrivilege 848 taskmgr.exe
Token: SeCreateGlobalPrivilege 848 taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	848	taskmgr.exe
Token: SeSystemProfilePrivilege	848	taskmgr.exe
Token: SeCreateGlobalPrivilege	848	taskmgr.exe

Suspicious use of FindShellTrayWindow 32 IoCs

Processes:

taskmgr.exe

pid	process
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe

Suspicious use of SendNotifyMessage 31 IoCs

Processes:

taskmgr.exe

pid	process
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe
848	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

CheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exeCheatInjector.exe

description	pid	process	target process
PID 4124 wrote to memory of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 4124 wrote to memory of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 4124 wrote to memory of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 4124 wrote to memory of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 4124 wrote to memory of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 4124 wrote to memory of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 4124 wrote to memory of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 4124 wrote to memory of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 4124 wrote to memory of 1864	4124	CheatInjector.exe	RegAsm.exe
PID 2100 wrote to memory of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 2100 wrote to memory of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 2100 wrote to memory of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 2100 wrote to memory of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 2100 wrote to memory of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 2100 wrote to memory of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 2100 wrote to memory of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 2100 wrote to memory of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 2100 wrote to memory of 1640	2100	CheatInjector.exe	RegAsm.exe
PID 5092 wrote to memory of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 5092 wrote to memory of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 5092 wrote to memory of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 5092 wrote to memory of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 5092 wrote to memory of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 5092 wrote to memory of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 5092 wrote to memory of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 5092 wrote to memory of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 5092 wrote to memory of 2644	5092	CheatInjector.exe	RegAsm.exe
PID 2928 wrote to memory of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 2928 wrote to memory of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 2928 wrote to memory of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 2928 wrote to memory of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 2928 wrote to memory of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 2928 wrote to memory of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 2928 wrote to memory of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 2928 wrote to memory of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 2928 wrote to memory of 2300	2928	CheatInjector.exe	RegAsm.exe
PID 1592 wrote to memory of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 1592 wrote to memory of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 1592 wrote to memory of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 1592 wrote to memory of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 1592 wrote to memory of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 1592 wrote to memory of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 1592 wrote to memory of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 1592 wrote to memory of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 1592 wrote to memory of 2816	1592	CheatInjector.exe	RegAsm.exe
PID 3784 wrote to memory of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 3784 wrote to memory of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 3784 wrote to memory of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 3784 wrote to memory of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 3784 wrote to memory of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 3784 wrote to memory of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 3784 wrote to memory of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 3784 wrote to memory of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 3784 wrote to memory of 4796	3784	CheatInjector.exe	RegAsm.exe
PID 4528 wrote to memory of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 4528 wrote to memory of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 4528 wrote to memory of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 4528 wrote to memory of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 4528 wrote to memory of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 4528 wrote to memory of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 4528 wrote to memory of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 4528 wrote to memory of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 4528 wrote to memory of 3836	4528	CheatInjector.exe	RegAsm.exe
PID 1780 wrote to memory of 3632	1780	CheatInjector.exe	RegAsm.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Cheat.zip
1⤵
PID:3836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1452

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 152
2⤵
- Program crash
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4124 -ip 4124
1⤵
PID:4192

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 280
2⤵
- Program crash
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2100 -ip 2100
1⤵
PID:4344

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 268
2⤵
- Program crash
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5092 -ip 5092
1⤵
PID:1628

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 252
2⤵
- Program crash
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2928 -ip 2928
1⤵
PID:780

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 280
2⤵
- Program crash
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1592 -ip 1592
1⤵
PID:1368

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 136
2⤵
- Program crash
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3784 -ip 3784
1⤵
PID:4880

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 244
2⤵
- Program crash
PID:1176

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 292
2⤵
- Program crash
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4528 -ip 4528
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1780 -ip 1780
1⤵
PID:2216

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:5092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 288
2⤵
- Program crash
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4300 -ip 4300
1⤵
PID:3352

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:848

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 300
2⤵
- Program crash
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4940 -ip 4940
1⤵
PID:5084

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 288
2⤵
- Program crash
PID:4820

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 196
2⤵
- Program crash
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3232 -ip 3232
1⤵
PID:4200

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2388

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 280
2⤵
- Program crash
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3852 -ip 3852
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2388 -ip 2388
1⤵
PID:4736

C:\Users\Admin\Desktop\sa\CheatInjector.exe
"C:\Users\Admin\Desktop\sa\CheatInjector.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2196

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 300
2⤵
- Program crash
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2196 -ip 2196
1⤵
PID:904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-33-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/848-24-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/848-31-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/848-30-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/848-26-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/848-32-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/848-35-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/848-25-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/848-36-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/848-34-0x000001CC766B0000-0x000001CC766B1000-memory.dmp

Filesize
4KB

Download
memory/1640-9-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1864-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1864-4-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1864-3-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2100-8-0x00000000011C0000-0x00000000011C1000-memory.dmp

Filesize
4KB

Download
memory/4124-1-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download