Analysis
-
max time kernel
173s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
15-01-2023 14:36
General
-
Target
482f9a21893127c2bf7477236533dc2db007ad1eb1fe6cc9ae7135bc71742abd.exe
-
Size
207KB
-
MD5
3a61ec110bb167c8e3a0cac282c1d3e7
-
SHA1
888b06642f643b8b36c5db2b4cda28a17f6affaa
-
SHA256
482f9a21893127c2bf7477236533dc2db007ad1eb1fe6cc9ae7135bc71742abd
-
SHA512
5176bb10cf36e018689f030514cf7180a5ca74c8b63ed12037896813ea4267987f062c825c68d0b0b11aa6e3702ab627c528bf34292f0d19d3a5b572c93bd679
-
SSDEEP
3072:XXtTlv1Y3V7I50QVzPRSRC1VvTdnUx3cOfg6o5W/i:Hj12uVOGvTNUxmI
Malware Config
Extracted
lumma
77.73.134.68
Signatures
-
Detects Smokeloader packer 1 IoCs
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\482f9a21893127c2bf7477236533dc2db007ad1eb1fe6cc9ae7135bc71742abd.exe"C:\Users\Admin\AppData\Local\Temp\482f9a21893127c2bf7477236533dc2db007ad1eb1fe6cc9ae7135bc71742abd.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1018.exeC:\Users\Admin\AppData\Local\Temp\1018.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 13442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2712 -ip 27121⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD50ccbec377710f5e58b2d01685f1ecb72
SHA1af747d213c4a3dad010b455f42439bf60b9880a1
SHA256aa3a7343485d41c250d2ccfe85d8efd16e9e9f1a4c648e67c109998fa6b049b5
SHA512dabb331a125b87726c387ca24380f8d58074773ebb75dd526cbbe9ef8304efeafb81f0b7dea4dd4546c3ffd7a78fbf2bbe3afdaeb57f98f96ec3ec36902820e7
-
Filesize
245KB
MD50ccbec377710f5e58b2d01685f1ecb72
SHA1af747d213c4a3dad010b455f42439bf60b9880a1
SHA256aa3a7343485d41c250d2ccfe85d8efd16e9e9f1a4c648e67c109998fa6b049b5
SHA512dabb331a125b87726c387ca24380f8d58074773ebb75dd526cbbe9ef8304efeafb81f0b7dea4dd4546c3ffd7a78fbf2bbe3afdaeb57f98f96ec3ec36902820e7
-
-
Filesize
168KB
-
Filesize
104KB
-
Filesize
39.6MB
-
Filesize
39.6MB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
39.6MB
-
Filesize
39.6MB