Analysis

  • max time kernel
    148s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2023, 20:05

General

  • Target

    NewVersionUnlimited/Desktop_Full/Setup_x64.exe

  • Size

    689.5MB

  • MD5

    70de17cb6cc2d93d2315cb85c5df9e3d

  • SHA1

    249f6e435746f70547aa61f91b90fcbb0270eb03

  • SHA256

    7cc6d947930ba76738f80c8173482f9c7aa72b967af6504ea437c4b9c734602a

  • SHA512

    9ee27d5ecff8653763d2a1cacd982333ca9a400619d76a4d1626a53683944f0aa053be6cb962a720eefb08e0c05eba1ff2ca3c7b0a7fea89d1b3da52786ef44c

  • SSDEEP

    6144:YB1ySr9qqgdLTMHiDAOEamFbh4Ck9rIjc2NtDbQRw/Kltlg1wlvt:YBjr9qqcR8Fbh4xIjxNNbW6Ky1Yvt

Score
10/10

Malware Config

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NewVersionUnlimited\Desktop_Full\Setup_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\NewVersionUnlimited\Desktop_Full\Setup_x64.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:4480
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 156
        2⤵
        • Program crash
        PID:332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 852 -ip 852
      1⤵
        PID:4820

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4480-133-0x00000000005C0000-0x00000000005F9000-memory.dmp

              Filesize

              228KB