Overview
overview
10Static
static
10Samples 1/...cd.exe
windows7-x64
10Samples 1/...cd.exe
windows10-2004-x64
10Samples 1/...9f.exe
windows7-x64
10Samples 1/...9f.exe
windows10-2004-x64
7Samples 1/...95.exe
windows7-x64
10Samples 1/...95.exe
windows10-2004-x64
5Samples 1/...d2.exe
windows7-x64
10Samples 1/...d2.exe
windows10-2004-x64
10Samples 1/...6c.exe
windows7-x64
10Samples 1/...6c.exe
windows10-2004-x64
10Samples 1/...e8.exe
windows7-x64
10Samples 1/...e8.exe
windows10-2004-x64
10Samples 1/...4f.exe
windows7-x64
10Samples 1/...4f.exe
windows10-2004-x64
10Samples 1/...0a.exe
windows7-x64
7Samples 1/...0a.exe
windows10-2004-x64
7Samples 1/...a5.exe
windows7-x64
10Samples 1/...a5.exe
windows10-2004-x64
10Samples 1/...f4.exe
windows7-x64
10Samples 1/...f4.exe
windows10-2004-x64
10Samples 1/...c3.exe
windows7-x64
7Samples 1/...c3.exe
windows10-2004-x64
7Samples 1/...c7.exe
windows7-x64
10Samples 1/...c7.exe
windows10-2004-x64
10Samples 1/...26.exe
windows7-x64
10Samples 1/...26.exe
windows10-2004-x64
10Samples 1/...3a.exe
windows7-x64
1Samples 1/...3a.exe
windows10-2004-x64
1Samples 1/...91.exe
windows7-x64
10Samples 1/...91.exe
windows10-2004-x64
10Samples 2/...c4.exe
windows7-x64
10Samples 2/...c4.exe
windows10-2004-x64
10Analysis
-
max time kernel
130s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07-01-2024 18:26
Static task
static1
Behavioral task
behavioral1
Sample
Samples 1/0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Samples 1/0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
Samples 1/0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Samples 1/0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
Samples 1/2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Samples 1/2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
Samples 1/3c36a35096a0e4ad330d8ae5953d844db3af5d0fa1780782a6a1adf32550fda5.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
Samples 1/3c36a35096a0e4ad330d8ae5953d844db3af5d0fa1780782a6a1adf32550fda5.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
Samples 1/3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
Samples 1/3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
Samples 1/4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
Samples 1/4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
Samples 2/10f4e5b89953a29f22a64373ec33b585af9b406a18710fec96d3adab993cbcc4.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
Samples 2/10f4e5b89953a29f22a64373ec33b585af9b406a18710fec96d3adab993cbcc4.exe
Resource
win10v2004-20231215-en
General
-
Target
Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe
-
Size
1.7MB
-
MD5
fee771c9a50a56880f6bce04874f6f5c
-
SHA1
e5a9f281eb91405004cd4f347db7b5f23f8d6b8f
-
SHA256
5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91
-
SHA512
e1cb760ddc11d2eeba73fd5bd3baabcebc82c7f41ed9a7cc2d7e30bf527ac6aaf3593536a57c3ac546ecf29b1521764f0412062a811645d0bbcf739ca579f422
-
SSDEEP
24576:3eHTg0cKA71b0+P7tT4o+AVDT2wEpXs+XFJP+jP2jetVS7cb6z54R7u9ud9Xu9cI:3TrTqAVm/JRX2IetVz6mRuaxt
Malware Config
Extracted
lumma
http://zamesblack.fun/api
Signatures
-
Detect Lumma Stealer payload V4 3 IoCs
Processes:
resource yara_rule behavioral29/memory/2952-32-0x0000000004170000-0x00000000041F6000-memory.dmp family_lumma_v4 behavioral29/memory/2952-33-0x0000000004170000-0x00000000041F6000-memory.dmp family_lumma_v4 behavioral29/memory/2952-34-0x0000000004170000-0x00000000041F6000-memory.dmp family_lumma_v4 -
Executes dropped EXE 1 IoCs
Processes:
Town.pifpid process 2952 Town.pif -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1040 cmd.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2260 tasklist.exe 2940 tasklist.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Town.pifpid process 2952 Town.pif 2952 Town.pif 2952 Town.pif 2952 Town.pif -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tasklist.exetasklist.exedescription pid process Token: SeDebugPrivilege 2260 tasklist.exe Token: SeDebugPrivilege 2940 tasklist.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Town.pifpid process 2952 Town.pif 2952 Town.pif 2952 Town.pif -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Town.pifpid process 2952 Town.pif 2952 Town.pif 2952 Town.pif -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.execmd.execmd.exedescription pid process target process PID 2712 wrote to memory of 2624 2712 5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe cmd.exe PID 2712 wrote to memory of 2624 2712 5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe cmd.exe PID 2712 wrote to memory of 2624 2712 5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe cmd.exe PID 2712 wrote to memory of 2624 2712 5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe cmd.exe PID 2624 wrote to memory of 1040 2624 cmd.exe cmd.exe PID 2624 wrote to memory of 1040 2624 cmd.exe cmd.exe PID 2624 wrote to memory of 1040 2624 cmd.exe cmd.exe PID 2624 wrote to memory of 1040 2624 cmd.exe cmd.exe PID 1040 wrote to memory of 2260 1040 cmd.exe tasklist.exe PID 1040 wrote to memory of 2260 1040 cmd.exe tasklist.exe PID 1040 wrote to memory of 2260 1040 cmd.exe tasklist.exe PID 1040 wrote to memory of 2260 1040 cmd.exe tasklist.exe PID 1040 wrote to memory of 2600 1040 cmd.exe findstr.exe PID 1040 wrote to memory of 2600 1040 cmd.exe findstr.exe PID 1040 wrote to memory of 2600 1040 cmd.exe findstr.exe PID 1040 wrote to memory of 2600 1040 cmd.exe findstr.exe PID 1040 wrote to memory of 2940 1040 cmd.exe tasklist.exe PID 1040 wrote to memory of 2940 1040 cmd.exe tasklist.exe PID 1040 wrote to memory of 2940 1040 cmd.exe tasklist.exe PID 1040 wrote to memory of 2940 1040 cmd.exe tasklist.exe PID 1040 wrote to memory of 2920 1040 cmd.exe findstr.exe PID 1040 wrote to memory of 2920 1040 cmd.exe findstr.exe PID 1040 wrote to memory of 2920 1040 cmd.exe findstr.exe PID 1040 wrote to memory of 2920 1040 cmd.exe findstr.exe PID 1040 wrote to memory of 2964 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 2964 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 2964 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 2964 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 2976 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 2976 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 2976 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 2976 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 3020 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 3020 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 3020 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 3020 1040 cmd.exe cmd.exe PID 1040 wrote to memory of 2952 1040 cmd.exe Town.pif PID 1040 wrote to memory of 2952 1040 cmd.exe Town.pif PID 1040 wrote to memory of 2952 1040 cmd.exe Town.pif PID 1040 wrote to memory of 2952 1040 cmd.exe Town.pif PID 1040 wrote to memory of 2016 1040 cmd.exe PING.EXE PID 1040 wrote to memory of 2016 1040 cmd.exe PING.EXE PID 1040 wrote to memory of 2016 1040 cmd.exe PING.EXE PID 1040 wrote to memory of 2016 1040 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Samples 1\5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe"C:\Users\Admin\AppData\Local\Temp\Samples 1\5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /k cmd < Sorry & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir 179104⤵
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Edges + Inf + Foul + Entrepreneurs 17910\Town.pif4⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost4⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\11560\17910\Town.pif17910\Town.pif 17910\a4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Admit + Like + Yu 17910\a4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\11560\17910\Town.pifFilesize
520KB
MD58c75c8c52cc76230d840e18259f3fb22
SHA1886d331c87bc156ec1b999f60108d0af9a50c0b7
SHA25644218d9a4625172005d46e71780620e16b9cc65580762dfe2aa84e1ef39a1faf
SHA5128adc4d548ea7acfc6a9bb41c8bea893b3a14d69c8ee70229940835460b627bb38ec9efda450059c023282bef89f7f45286724517c74b334b4455de2d686ac5af
-
C:\Users\Admin\AppData\Local\Temp\11560\17910\Town.pifFilesize
924KB
MD5848164d084384c49937f99d5b894253e
SHA13055ef803eeec4f175ebf120f94125717ee12444
SHA256f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
SHA512aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
-
C:\Users\Admin\AppData\Local\Temp\11560\17910\aFilesize
97KB
MD5e904085037daa318f4a21c3675159b0f
SHA1f0347349e416a2296add28c41b684540ad22f266
SHA2561c2ea72f00147e3fed095621ef75e82d1d5c0642c137e900575ee33962f90a2d
SHA512205abaa23365c99f941b8c6b58a3fe03539d1fc34bdd1acb7084a5788110e763e4d9a29fdaf1818e3e201f853d87ee2773ca7c83f0bbd7975d0157275e828a0d
-
C:\Users\Admin\AppData\Local\Temp\11560\AdmitFilesize
446KB
MD52b3c9515510eee0dc19c67772f793c4f
SHA16d4c851e63dd8d7073e9d9fbf2603bbab7b60100
SHA2567bfbe7b40752a99a4405031be7a92ee835238bd098081afe527663fa4f8ac4bf
SHA512470cf48f1e3966865eb3c6bea8d14fe67444069a6c689451271ec968a320d1496432956b21f6746b3c5d72c1b241c166da5cda3abf7c2e767c0817d98c1e899e
-
C:\Users\Admin\AppData\Local\Temp\11560\EdgesFilesize
250KB
MD5bc38068047fa909483d2029dbd56a138
SHA1447a3143f062a11854eba0db83c4b1e8ee5649ce
SHA25665f59b33867862480eb3765dbbe8666cd038770daf6d22761cf0a5f50613221f
SHA51211f0acbedc74dd6ff1979b238b2bed638f55f4fb2a0c6503e48d6be66c8d360600dc1c41d0a161ea8568598f9117d3c998e1e2825959078eb6942d7d5270fb1e
-
C:\Users\Admin\AppData\Local\Temp\11560\EntrepreneursFilesize
219KB
MD5f27a3c6f675ef8dc39afa3e9d1ca52f1
SHA150c617f9727877f69cb45d0860110508e5ddd99a
SHA256107c9f5f21d19fd781218ef317597a5039ba9fe22a908a5b610ee60480059d3f
SHA512f5452015f2eb9c6b0452bd1729b06baea9d5a2848594bed478e3c949266fa8438c552f2961d19a4624f981ba552e9525bc42188792a75babbee98c0f1557db1a
-
C:\Users\Admin\AppData\Local\Temp\11560\FoulFilesize
190KB
MD50fb98b666cec21e6a510379372988208
SHA12701956d358029eacffc086adf94cfb287744d5b
SHA256c5f575ab19db378b1303debb9b5417cb14fde8f330667f71fe93230ea9b33926
SHA5125285f84364c501c828081f3c12fb0e407edabe77aa13634ffdb1344460f969faf5fbdf08bc66ebf93551421442993d9650728bfc7fc10da582031bc64892a86f
-
C:\Users\Admin\AppData\Local\Temp\11560\InfFilesize
265KB
MD5f7b1477adc53dd39d4d4095c5ef777ea
SHA1fe4fefd565e79d3417f527bbf3586d93519304aa
SHA2561c2d1a532679278f12fc4994195f1e190da14424e781caa9ebbb2e8615d0d899
SHA512cb521aaa5f53c8816e379b17740a88c3c1290a6e6dc06ad1bcd23d56681a1b52ba3250f5ecd4416e2eb3da35dca1501a67eca0835e6ed4a7cb71fe2d45612d50
-
C:\Users\Admin\AppData\Local\Temp\11560\LikeFilesize
404KB
MD52369acddad6dc5da2a87623b652974d9
SHA1efc1441d1ddbc0c36011676415841c49a5a0223c
SHA2563d470e1b625e72b8b89d18236380074c2893c42371a04670d1ca9b27ac825738
SHA512d3330f2e186c7c438f8394ac485ac55c2f5ecb6430fe30fd929aa3451e5f8dbec8ac1ce0a0ee7c7d7687a7290752043b5811a76ee80497044d42156f41ded112
-
C:\Users\Admin\AppData\Local\Temp\11560\SorryFilesize
11KB
MD526413b5e758c26171fec67d8139b8482
SHA142548f7957d4d19b3afbd6b81405a2d80f638c55
SHA25624017740ee1bd1195a54de9b174823a2a6fde0f04cbd5bfbde5917b4bf760d30
SHA5124f1631b328c863e03e2157aa178f7a99b63bfec61a8416c0ec2bb9ba546b58ddef880149fc1800493846f79342f66939d1067f8a2d44f407563983082db8121d
-
C:\Users\Admin\AppData\Local\Temp\11560\YuFilesize
278KB
MD55ac68d1e171391b319399de52fb5472a
SHA1690f71693528b9ae7718a1bfc580d8588f1f06ae
SHA256b0743290c227ea97f6c03ff7a9f0027a0c9c0c82ad028fb100ac46e09250782a
SHA512c4615167cd5b6f336cab0690efcd5893e328de8a7def90142a8e8104953e7a5ec832ce82db37582cad52b335a950f841da6d7640f008a15b9921a9acddc14c04
-
memory/2712-12-0x0000000000600000-0x00000000007B1000-memory.dmpFilesize
1.7MB
-
memory/2712-0-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2712-6-0x0000000000600000-0x00000000007B1000-memory.dmpFilesize
1.7MB
-
memory/2712-5-0x0000000000600000-0x00000000007B1000-memory.dmpFilesize
1.7MB
-
memory/2712-26-0x0000000000600000-0x00000000007B1000-memory.dmpFilesize
1.7MB
-
memory/2952-28-0x0000000004170000-0x00000000041F6000-memory.dmpFilesize
536KB
-
memory/2952-27-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/2952-29-0x0000000004170000-0x00000000041F6000-memory.dmpFilesize
536KB
-
memory/2952-30-0x0000000004170000-0x00000000041F6000-memory.dmpFilesize
536KB
-
memory/2952-31-0x0000000004170000-0x00000000041F6000-memory.dmpFilesize
536KB
-
memory/2952-32-0x0000000004170000-0x00000000041F6000-memory.dmpFilesize
536KB
-
memory/2952-33-0x0000000004170000-0x00000000041F6000-memory.dmpFilesize
536KB
-
memory/2952-34-0x0000000004170000-0x00000000041F6000-memory.dmpFilesize
536KB