General
-
Target
6ced9e727c4a65bccd446cfd6b6222f5261c5ac97a798ddb729a931492c654b7
-
Size
210KB
-
Sample
230115-y1vwnsff61
-
MD5
9ab2e2eb1ac2586e07d6104d01cd1b90
-
SHA1
b6f267f80605be7aa59691f4ce0779572a59abb7
-
SHA256
6ced9e727c4a65bccd446cfd6b6222f5261c5ac97a798ddb729a931492c654b7
-
SHA512
c7863e97837427614eac42e64c89b5e0cb943ee4978c3267146cd977055a57476ca4cdf80a033120584ad5f66cbbd427496bceeebc6dc8103f76d577ca3dac45
-
SSDEEP
3072:HX1QDSkCkos5p4msqoovTbx/np2u7LBwcri:343EmNDPmuv
Static task
static1
Behavioral task
behavioral1
Sample
6ced9e727c4a65bccd446cfd6b6222f5261c5ac97a798ddb729a931492c654b7.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
lumma
77.73.134.68
Targets
-
-
Target
6ced9e727c4a65bccd446cfd6b6222f5261c5ac97a798ddb729a931492c654b7
-
Size
210KB
-
MD5
9ab2e2eb1ac2586e07d6104d01cd1b90
-
SHA1
b6f267f80605be7aa59691f4ce0779572a59abb7
-
SHA256
6ced9e727c4a65bccd446cfd6b6222f5261c5ac97a798ddb729a931492c654b7
-
SHA512
c7863e97837427614eac42e64c89b5e0cb943ee4978c3267146cd977055a57476ca4cdf80a033120584ad5f66cbbd427496bceeebc6dc8103f76d577ca3dac45
-
SSDEEP
3072:HX1QDSkCkos5p4msqoovTbx/np2u7LBwcri:343EmNDPmuv
-
Detects Smokeloader packer
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-