Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-01-2023 10:21
Static task
static1
General
-
Target
fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b.exe
-
Size
251KB
-
MD5
fe7dd689396bf62715c45735c2761eca
-
SHA1
2d7e535ddafa3eb554f87314c8a3634d819dc778
-
SHA256
fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b
-
SHA512
4cd59f82e826efe24c19a8f1d009ac021ad8f2b75006a1babb22141bcd5f76cdec0960680868e11604ee5a896c2494cbcde72349901916888f4d09cf68ccac51
-
SSDEEP
6144:V1W1XLCCPACUbYmS7beQXgmyYNOf7rd4VDHXyUC:V1WB2oAxub5s2O3ci
Malware Config
Extracted
Family
lumma
C2
77.73.134.68
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2092 868 WerFault.exe fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b.exe"C:\Users\Admin\AppData\Local\Temp\fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 13362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 868 -ip 8681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/868-132-0x000000000068E000-0x00000000006A8000-memory.dmpFilesize
104KB
-
memory/868-133-0x00000000005E0000-0x000000000060A000-memory.dmpFilesize
168KB
-
memory/868-134-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/868-135-0x000000000068E000-0x00000000006A8000-memory.dmpFilesize
104KB
-
memory/868-136-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB