General
-
Target
9346ecdc93d4b56498d6250c1908600ec8aefd58ad5b26d5fac5ba36200ebf93
-
Size
209KB
-
Sample
230115-yblayafb8w
-
MD5
ec1c23cf77e83ea1fab263c82d65874b
-
SHA1
e1e660b8016ab94272eddca344454c95f8decd87
-
SHA256
9346ecdc93d4b56498d6250c1908600ec8aefd58ad5b26d5fac5ba36200ebf93
-
SHA512
c93a973de382932810c6f784bf7031c0468a31e5020453eefa4742cb42d36f1cee56c161d7fd26cfef7602039b56da9ea8b7bd9b5a817ecad6e0c88c43401d66
-
SSDEEP
3072:yXmvzN63/s5Rmdkc1ra6Dq98krk3uJjMHliIi:ydXdkmravkl
Static task
static1
Behavioral task
behavioral1
Sample
9346ecdc93d4b56498d6250c1908600ec8aefd58ad5b26d5fac5ba36200ebf93.exe
Resource
win10-20220901-en
Malware Config
Extracted
lumma
77.73.134.68
Targets
-
-
Target
9346ecdc93d4b56498d6250c1908600ec8aefd58ad5b26d5fac5ba36200ebf93
-
Size
209KB
-
MD5
ec1c23cf77e83ea1fab263c82d65874b
-
SHA1
e1e660b8016ab94272eddca344454c95f8decd87
-
SHA256
9346ecdc93d4b56498d6250c1908600ec8aefd58ad5b26d5fac5ba36200ebf93
-
SHA512
c93a973de382932810c6f784bf7031c0468a31e5020453eefa4742cb42d36f1cee56c161d7fd26cfef7602039b56da9ea8b7bd9b5a817ecad6e0c88c43401d66
-
SSDEEP
3072:yXmvzN63/s5Rmdkc1ra6Dq98krk3uJjMHliIi:ydXdkmravkl
-
Detects Smokeloader packer
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-