Analysis

  • max time kernel
    140s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2024, 07:44

General

  • Target

    6a8a4bbb19d86c40938a18771c9ff4c1.exe

  • Size

    3.9MB

  • MD5

    6a8a4bbb19d86c40938a18771c9ff4c1

  • SHA1

    9416b64c873fafd2835cabeae9a322ee6671de10

  • SHA256

    bf7942c4a7de7c08083c2bb5961fe1b3fd7f5ab22f8bec2b0494d294aa4db32c

  • SHA512

    0523dfb127be53033b593ae1a410d6f08d4f8fee30b07f930244619a2cf21b5e0cf50c5ba5ea6060918bba3fd9029e0940b29ba90fab5886d91f5ef915450a28

  • SSDEEP

    49152:v3Pgz0GsP/7CYR3UTBb0xLCrSnBS4Guvx99yeUgncOVS/Ay06hPXql022:fPu0FP2jBbsnM4rvlyeUgcISB00S

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://goddirtybrilliancece.fun/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a8a4bbb19d86c40938a18771c9ff4c1.exe
    "C:\Users\Admin\AppData\Local\Temp\6a8a4bbb19d86c40938a18771c9ff4c1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1364
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:1264
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 900
          3⤵
          • Program crash
          PID:4740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1012
        2⤵
        • Program crash
        PID:4592
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1364 -ip 1364
      1⤵
        PID:2664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1264 -ip 1264
        1⤵
          PID:736

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

                Filesize

                261KB

                MD5

                6f9627a9c6cb99bfb4cb01679d40ed28

                SHA1

                278097b131c737c306be4e8c064b104c1911fe58

                SHA256

                f8fdd38f0d90bf025b959a47985aa6f04eeda24e3705b90ddf177f906e492504

                SHA512

                a682bd6f8822814332b396bdda2b43f27485bc2b396f1aef582fb33a8d1213c9be65a8869b5167a347bbbc2dd35ffa184fc38467da9805570399da47d618a430

              • memory/1264-28-0x0000000000EA0000-0x0000000000ED2000-memory.dmp

                Filesize

                200KB

              • memory/1264-33-0x0000000000400000-0x0000000000498000-memory.dmp

                Filesize

                608KB

              • memory/1264-32-0x0000000000EA0000-0x0000000000ED2000-memory.dmp

                Filesize

                200KB

              • memory/1264-31-0x0000000000EA0000-0x0000000000ED2000-memory.dmp

                Filesize

                200KB

              • memory/1264-22-0x0000000000400000-0x0000000000498000-memory.dmp

                Filesize

                608KB

              • memory/1264-25-0x0000000000400000-0x0000000000498000-memory.dmp

                Filesize

                608KB

              • memory/1264-29-0x0000000000EA0000-0x0000000000ED2000-memory.dmp

                Filesize

                200KB

              • memory/1264-26-0x0000000000400000-0x0000000000498000-memory.dmp

                Filesize

                608KB

              • memory/1264-27-0x0000000000EA0000-0x0000000000ED2000-memory.dmp

                Filesize

                200KB

              • memory/1364-16-0x0000000005B80000-0x0000000005B90000-memory.dmp

                Filesize

                64KB

              • memory/1364-19-0x0000000007750000-0x0000000007850000-memory.dmp

                Filesize

                1024KB

              • memory/1364-13-0x0000000005B80000-0x0000000005B90000-memory.dmp

                Filesize

                64KB

              • memory/1364-14-0x0000000005B80000-0x0000000005B90000-memory.dmp

                Filesize

                64KB

              • memory/1364-15-0x0000000007680000-0x0000000007690000-memory.dmp

                Filesize

                64KB

              • memory/1364-1-0x0000000000CE0000-0x00000000010C8000-memory.dmp

                Filesize

                3.9MB

              • memory/1364-6-0x0000000007260000-0x00000000073F2000-memory.dmp

                Filesize

                1.6MB

              • memory/1364-5-0x0000000005F00000-0x0000000006126000-memory.dmp

                Filesize

                2.1MB

              • memory/1364-20-0x0000000007750000-0x0000000007850000-memory.dmp

                Filesize

                1024KB

              • memory/1364-21-0x0000000007750000-0x0000000007850000-memory.dmp

                Filesize

                1024KB

              • memory/1364-18-0x0000000005B80000-0x0000000005B90000-memory.dmp

                Filesize

                64KB

              • memory/1364-17-0x0000000005B80000-0x0000000005B90000-memory.dmp

                Filesize

                64KB

              • memory/1364-12-0x0000000005B80000-0x0000000005B90000-memory.dmp

                Filesize

                64KB

              • memory/1364-4-0x0000000005B80000-0x0000000005B90000-memory.dmp

                Filesize

                64KB

              • memory/1364-30-0x0000000074910000-0x00000000750C0000-memory.dmp

                Filesize

                7.7MB

              • memory/1364-3-0x0000000074910000-0x00000000750C0000-memory.dmp

                Filesize

                7.7MB

              • memory/1364-2-0x0000000005AA0000-0x0000000005B3C000-memory.dmp

                Filesize

                624KB

              • memory/1364-0-0x0000000074910000-0x00000000750C0000-memory.dmp

                Filesize

                7.7MB