Analysis
-
max time kernel
269s -
max time network
251s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-es -
resource tags
-
submitted
19-01-2023 01:32
General
-
Target
windows.exe
-
Size
5.5MB
-
MD5
caa7805c7dc283359293bae074cb85ec
-
SHA1
f21c4880fbf40b8f03ed8954263106d814ac014d
-
SHA256
e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23
-
SHA512
206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1
-
SSDEEP
98304:E6mIaXo6zdDzxzWfqyD+OHSpUijWAsIC0A6NNU4chmX+dLFR:E6mY69zN8HSWijWAsIFA6NNvYmXuLL
Malware Config
Signatures
-
Lampion
Lampion is a banking trojan, targeting Portuguese speaking countries.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4216-132-0x0000000000960000-0x0000000001AC0000-memory.dmpFilesize
17.4MB
-
memory/4216-133-0x0000000000960000-0x0000000001AC0000-memory.dmpFilesize
17.4MB
-
memory/4216-134-0x0000000000960000-0x0000000001AC0000-memory.dmpFilesize
17.4MB
-
memory/4216-135-0x0000000077280000-0x0000000077423000-memory.dmpFilesize
1.6MB
-
memory/4216-136-0x0000000000960000-0x0000000001AC0000-memory.dmpFilesize
17.4MB
-
memory/4216-137-0x0000000000960000-0x0000000001AC0000-memory.dmpFilesize
17.4MB
-
memory/4216-138-0x0000000000960000-0x0000000001AC0000-memory.dmpFilesize
17.4MB
-
memory/4216-139-0x0000000000960000-0x0000000001AC0000-memory.dmpFilesize
17.4MB
-
memory/4216-140-0x0000000077280000-0x0000000077423000-memory.dmpFilesize
1.6MB
-
memory/4216-141-0x0000000009F20000-0x000000000F896000-memory.dmpFilesize
89.5MB
-
memory/4216-142-0x0000000009F20000-0x000000000F896000-memory.dmpFilesize
89.5MB