Analysis
-
max time kernel
39s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
submitted
19-09-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
Malware Config
Extracted
Family
lumma
C2
http://evetesttech.net
Signatures
-
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0.exepid process 1408 bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\sqlite3.dllFilesize
962KB
MD568fcae2f9bdb38fdfa4e7826a45a494e
SHA18a3c69f5d9140b07a8fcf578ce479cd4b1295003
SHA2569dc0373e28a45187528591a3ed0eabc4c4a2a6d3eeb8e38c3f451fc11d9e5b48
SHA5128e916967fc1995a68de2cdf878ac4c5a5c16f226d92b78ce1bb30047f9e6834886791cf7b7f03485aec5ac0d31dbba28deef2354b1b18d58fd798473f12759c7
-
memory/1408-54-0x00000000750A1000-0x00000000750A3000-memory.dmpFilesize
8KB
-
memory/1408-55-0x000000000094B000-0x0000000000968000-memory.dmpFilesize
116KB
-
memory/1408-56-0x0000000000230000-0x000000000025E000-memory.dmpFilesize
184KB
-
memory/1408-57-0x0000000000400000-0x000000000085A000-memory.dmpFilesize
4.4MB
-
memory/1408-59-0x000000000094B000-0x0000000000968000-memory.dmpFilesize
116KB
-
memory/1408-60-0x0000000000400000-0x000000000085A000-memory.dmpFilesize
4.4MB