Analysis

  • max time kernel
    54s
  • max time network
    64s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24/04/2023, 20:05

General

  • Target

    NewVersionUnlimited/Desktop_Full/Setup_x64.exe

  • Size

    689.5MB

  • MD5

    70de17cb6cc2d93d2315cb85c5df9e3d

  • SHA1

    249f6e435746f70547aa61f91b90fcbb0270eb03

  • SHA256

    7cc6d947930ba76738f80c8173482f9c7aa72b967af6504ea437c4b9c734602a

  • SHA512

    9ee27d5ecff8653763d2a1cacd982333ca9a400619d76a4d1626a53683944f0aa053be6cb962a720eefb08e0c05eba1ff2ca3c7b0a7fea89d1b3da52786ef44c

  • SSDEEP

    6144:YB1ySr9qqgdLTMHiDAOEamFbh4Ck9rIjc2NtDbQRw/Kltlg1wlvt:YBjr9qqcR8Fbh4xIjxNNbW6Ky1Yvt

Score
10/10

Malware Config

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NewVersionUnlimited\Desktop_Full\Setup_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\NewVersionUnlimited\Desktop_Full\Setup_x64.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:1096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 36
        2⤵
        • Program crash
        PID:268

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1096-54-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

          • memory/1096-55-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

          • memory/1096-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB