Analysis
-
max time kernel
159s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 12:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SoftWare.exe
Resource
win7-20231215-en
3 signatures
150 seconds
General
-
Target
SoftWare.exe
-
Size
758KB
-
MD5
0462ee257d052e3ee8a64f9ecb7f5f2f
-
SHA1
fcaf1010cff904c8e8b46cec2ddd6b0f1fd6aad4
-
SHA256
0abd9055702e5708497f5cd1032c9f57f5c4b2a5acb60309ef9e605213b1d41b
-
SHA512
4d9b5dbba521300d1b994754967224b448cd654430388f6993765b6aed7e3454801f798f97e4e997422b4ab060b2746824a240acf2ff8bae0990e5d206730bce
-
SSDEEP
12288:+i87P1HvYxCi3F2umVkNqnzPmYEF/lHFe0XM5+iPq30zViKBa05R:I7P1PYx13oBtzMTFrXM5+H30zsKBa0
Malware Config
Extracted
Family
lumma
C2
https://goddirtybrilliancece.fun/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1404 set thread context of 220 1404 SoftWare.exe 88 -
Program crash 2 IoCs
pid pid_target Process procid_target 2856 220 WerFault.exe 88 5036 220 WerFault.exe 88 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1404 SoftWare.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1404 wrote to memory of 220 1404 SoftWare.exe 88 PID 1404 wrote to memory of 220 1404 SoftWare.exe 88 PID 1404 wrote to memory of 220 1404 SoftWare.exe 88 PID 1404 wrote to memory of 220 1404 SoftWare.exe 88 PID 1404 wrote to memory of 220 1404 SoftWare.exe 88 PID 1404 wrote to memory of 220 1404 SoftWare.exe 88 PID 1404 wrote to memory of 220 1404 SoftWare.exe 88 PID 1404 wrote to memory of 220 1404 SoftWare.exe 88 PID 1404 wrote to memory of 220 1404 SoftWare.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\SoftWare.exe"C:\Users\Admin\AppData\Local\Temp\SoftWare.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 11963⤵
- Program crash
PID:2856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 8163⤵
- Program crash
PID:5036
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 220 -ip 2201⤵PID:5056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 220 -ip 2201⤵PID:1164