Analysis

  • max time kernel
    145s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2024, 13:46

General

  • Target

    5b64beac3ccc5e930abc126acb321f69.exe

  • Size

    1.4MB

  • MD5

    5b64beac3ccc5e930abc126acb321f69

  • SHA1

    af5e1e302babb0c8ace3b32e62939b5a384fc995

  • SHA256

    f28ab8cbbb965f2322c5d9f027ce225fef5711a3d39bbc346a225e889e15c927

  • SHA512

    f12b15c0cb36d4b44ea808656a0e5d047a439951f78ef4d5f9ccac7c2a58bea0c9e7ba964a8b0e265202e39c3f6bf8ebd8ee70b2d731bc9765a10af22ff94730

  • SSDEEP

    24576:yUWfZRRQEuIrvUhrTNn9MLATTajzu7fBCd8IGDlKSwwrTEzy1xeFSWQ01i2ZuhTT:tWb9qrTrTTE6rlQSwwrQzyDN+i2qd

Malware Config

Signatures

  • Detect Lumma Stealer payload V4 16 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies security service 2 TTPs 22 IoCs
  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 20 IoCs
  • Themida packer 25 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Drops file in System32 directory 22 IoCs
  • Runs .reg file with regedit 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b64beac3ccc5e930abc126acb321f69.exe
    "C:\Users\Admin\AppData\Local\Temp\5b64beac3ccc5e930abc126acb321f69.exe"
    1⤵
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:616
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Windows\SysWOW64\regedit.exe
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        3⤵
        • Modifies security service
        • Runs .reg file with regedit
        PID:2192
    • C:\Windows\SysWOW64\sound.exe
      C:\Windows\system32\sound.exe 708 "C:\Users\Admin\AppData\Local\Temp\5b64beac3ccc5e930abc126acb321f69.exe"
      2⤵
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c c:\a.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2868
        • C:\Windows\SysWOW64\regedit.exe
          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
          4⤵
          • Modifies security service
          • Runs .reg file with regedit
          PID:864
      • C:\Windows\SysWOW64\sound.exe
        C:\Windows\system32\sound.exe 716 "C:\Windows\SysWOW64\sound.exe"
        3⤵
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1692
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c c:\a.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2684
          • C:\Windows\SysWOW64\regedit.exe
            REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
            5⤵
            • Modifies security service
            • Runs .reg file with regedit
            PID:2040
        • C:\Windows\SysWOW64\sound.exe
          C:\Windows\system32\sound.exe 724 "C:\Windows\SysWOW64\sound.exe"
          4⤵
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2324
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c c:\a.bat
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2972
            • C:\Windows\SysWOW64\regedit.exe
              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
              6⤵
              • Modifies security service
              • Runs .reg file with regedit
              PID:1892
          • C:\Windows\SysWOW64\sound.exe
            C:\Windows\system32\sound.exe 720 "C:\Windows\SysWOW64\sound.exe"
            5⤵
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1796
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c c:\a.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2656
              • C:\Windows\SysWOW64\regedit.exe
                REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                7⤵
                • Modifies security service
                • Runs .reg file with regedit
                PID:1720
            • C:\Windows\SysWOW64\sound.exe
              C:\Windows\system32\sound.exe 732 "C:\Windows\SysWOW64\sound.exe"
              6⤵
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2276
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c c:\a.bat
                7⤵
                  PID:2728
                  • C:\Windows\SysWOW64\regedit.exe
                    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                    8⤵
                    • Modifies security service
                    • Runs .reg file with regedit
                    PID:2820
                • C:\Windows\SysWOW64\sound.exe
                  C:\Windows\system32\sound.exe 736 "C:\Windows\SysWOW64\sound.exe"
                  7⤵
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1512
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c c:\a.bat
                    8⤵
                      PID:864
                      • C:\Windows\SysWOW64\regedit.exe
                        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                        9⤵
                        • Modifies security service
                        • Runs .reg file with regedit
                        PID:1720
                    • C:\Windows\SysWOW64\sound.exe
                      C:\Windows\system32\sound.exe 740 "C:\Windows\SysWOW64\sound.exe"
                      8⤵
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1820
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c c:\a.bat
                        9⤵
                          PID:2704
                        • C:\Windows\SysWOW64\sound.exe
                          C:\Windows\system32\sound.exe 728 "C:\Windows\SysWOW64\sound.exe"
                          9⤵
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Loads dropped DLL
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1556
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c c:\a.bat
                            10⤵
                              PID:1040
                              • C:\Windows\SysWOW64\regedit.exe
                                REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                11⤵
                                • Modifies security service
                                • Runs .reg file with regedit
                                PID:2500
                            • C:\Windows\SysWOW64\sound.exe
                              C:\Windows\system32\sound.exe 744 "C:\Windows\SysWOW64\sound.exe"
                              10⤵
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Loads dropped DLL
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              PID:472
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c c:\a.bat
                                11⤵
                                  PID:2920
                                  • C:\Windows\SysWOW64\regedit.exe
                                    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                    12⤵
                                    • Modifies security service
                                    • Runs .reg file with regedit
                                    PID:3048
                                • C:\Windows\SysWOW64\sound.exe
                                  C:\Windows\system32\sound.exe 748 "C:\Windows\SysWOW64\sound.exe"
                                  11⤵
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1756
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c c:\a.bat
                                    12⤵
                                      PID:2664
                                      • C:\Windows\SysWOW64\regedit.exe
                                        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                        13⤵
                                        • Modifies security service
                                        • Runs .reg file with regedit
                                        PID:2944
              • C:\Windows\SysWOW64\regedit.exe
                REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                1⤵
                • Modifies security service
                • Runs .reg file with regedit
                PID:3068

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\1.reg

                      Filesize

                      3KB

                      MD5

                      9e5db93bd3302c217b15561d8f1e299d

                      SHA1

                      95a5579b336d16213909beda75589fd0a2091f30

                      SHA256

                      f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

                      SHA512

                      b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

                    • C:\Users\Admin\AppData\Local\Temp\1.reg

                      Filesize

                      2KB

                      MD5

                      d8be0d42e512d922804552250f01eb90

                      SHA1

                      cda2fd8fc9c4cdf15d5e2f07a4c633e21d11c9d3

                      SHA256

                      901619f668fe541b53d809cd550460f579985c3d2f3d899a557997e778eb1d82

                      SHA512

                      f53619e1ec3c9abc833f9fca1174529fb4a4723b64f7560059cd3147d74ea8fe945a7bd0034f6fb68c0e61b6782a26908d30a749a256e019031b5a6ac088eb97

                    • C:\Windows\SysWOW64\sound.exe

                      Filesize

                      1.1MB

                      MD5

                      86d4033ebb1c5d06cef3d63fd0f24790

                      SHA1

                      58760d76fa8caf84ec0e58529ded32e8e02eb1f2

                      SHA256

                      804a5ef5292cb0dfb93292de582b52c23aaf95bf28142953fa2d3a84a2947155

                      SHA512

                      16147bd9148f5778a075056bfb1d8f1a8839e31bff387d917ed9d1bbd626f8b50a588db60019fad12966b0722d9812007a5f1bc8985456cc5988b387fd13b2aa

                    • C:\Windows\SysWOW64\sound.exe

                      Filesize

                      513KB

                      MD5

                      1801590458979467498505e379109ec3

                      SHA1

                      1889764d4d9a35444985de8d13208a93abd218a4

                      SHA256

                      36098098f63c2d323273db2728f4f280be6f7a20641fdaf5599a7322a75a7ca6

                      SHA512

                      25430d8839c6a57bd5a081dc10e67e47ed21649accc4a3c98335d0f9b6d11a60f4ed9b72dc06bce5016bd14e41a14e5f5f4964601d2815a77cdd772631cbb5ae

                    • C:\a.bat

                      Filesize

                      5KB

                      MD5

                      0019a0451cc6b9659762c3e274bc04fb

                      SHA1

                      5259e256cc0908f2846e532161b989f1295f479b

                      SHA256

                      ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

                      SHA512

                      314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

                    • \Windows\SysWOW64\sound.exe

                      Filesize

                      1.4MB

                      MD5

                      5b64beac3ccc5e930abc126acb321f69

                      SHA1

                      af5e1e302babb0c8ace3b32e62939b5a384fc995

                      SHA256

                      f28ab8cbbb965f2322c5d9f027ce225fef5711a3d39bbc346a225e889e15c927

                      SHA512

                      f12b15c0cb36d4b44ea808656a0e5d047a439951f78ef4d5f9ccac7c2a58bea0c9e7ba964a8b0e265202e39c3f6bf8ebd8ee70b2d731bc9765a10af22ff94730

                    • \Windows\SysWOW64\sound.exe

                      Filesize

                      4KB

                      MD5

                      2456392ab2729f60fbb88b275163a235

                      SHA1

                      9d4a772c4de1ac5f1076f3e4d63bd0bf0baa8560

                      SHA256

                      766efbcc213ee708856648f4f0f51cdcea1bd5e2223af9ae0f6d1932f03e9680

                      SHA512

                      f010e4ef8f9c0f660ea99de032be19d77eec24d548e8c2b9f06cbb71188c2f832c19ca27fb93d11aec547405db6c5c519f15d9dd36d4c54ce32fc8635df23dbe

                    • memory/472-1268-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/616-13-0x0000000004500000-0x0000000004502000-memory.dmp

                      Filesize

                      8KB

                    • memory/616-144-0x0000000004B50000-0x0000000004F0B000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/616-21-0x00000000044C0000-0x00000000044C1000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-20-0x0000000004510000-0x0000000004511000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-19-0x00000000043F0000-0x00000000043F1000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-18-0x0000000004400000-0x0000000004402000-memory.dmp

                      Filesize

                      8KB

                    • memory/616-17-0x00000000044A0000-0x00000000044A2000-memory.dmp

                      Filesize

                      8KB

                    • memory/616-24-0x0000000004410000-0x0000000004411000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-16-0x00000000044D0000-0x00000000044D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-25-0x0000000004460000-0x0000000004461000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-15-0x00000000044E0000-0x00000000044E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-14-0x0000000004430000-0x0000000004432000-memory.dmp

                      Filesize

                      8KB

                    • memory/616-22-0x00000000044F0000-0x00000000044F1000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-0-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/616-23-0x00000000044B0000-0x00000000044B1000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-11-0x0000000004470000-0x0000000004471000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-149-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/616-148-0x0000000004B50000-0x0000000004F0B000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/616-12-0x0000000004440000-0x0000000004441000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-10-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/616-134-0x0000000004480000-0x0000000004481000-memory.dmp

                      Filesize

                      4KB

                    • memory/616-2-0x0000000002070000-0x0000000002166000-memory.dmp

                      Filesize

                      984KB

                    • memory/1512-911-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/1556-1149-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/1692-416-0x00000000044E0000-0x00000000044E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-424-0x00000000044B0000-0x00000000044B1000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-434-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/1692-428-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/1692-422-0x0000000004510000-0x0000000004511000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-425-0x0000000004410000-0x0000000004411000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-423-0x00000000044C0000-0x00000000044C1000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-421-0x0000000004230000-0x0000000004231000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-418-0x00000000044A0000-0x00000000044A2000-memory.dmp

                      Filesize

                      8KB

                    • memory/1692-419-0x0000000004400000-0x0000000004402000-memory.dmp

                      Filesize

                      8KB

                    • memory/1692-420-0x00000000044F0000-0x00000000044F1000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-411-0x0000000004470000-0x0000000004471000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-417-0x00000000044D0000-0x00000000044D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-414-0x0000000004500000-0x0000000004502000-memory.dmp

                      Filesize

                      8KB

                    • memory/1692-415-0x0000000004430000-0x0000000004431000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-413-0x0000000004440000-0x0000000004441000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-410-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/1692-295-0x0000000000270000-0x0000000000271000-memory.dmp

                      Filesize

                      4KB

                    • memory/1692-294-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/1796-673-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/1820-1030-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2260-277-0x0000000004520000-0x0000000004521000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-283-0x00000000044A0000-0x00000000044A1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-290-0x0000000004470000-0x0000000004471000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-288-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2260-284-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2260-151-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2260-268-0x0000000004510000-0x0000000004512000-memory.dmp

                      Filesize

                      8KB

                    • memory/2260-273-0x00000000044B0000-0x00000000044B2000-memory.dmp

                      Filesize

                      8KB

                    • memory/2260-271-0x00000000044F0000-0x00000000044F1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-274-0x0000000004400000-0x0000000004401000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-275-0x0000000004500000-0x0000000004501000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-276-0x00000000043F0000-0x00000000043F1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-293-0x0000000004B70000-0x0000000004F2B000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2260-278-0x00000000044D0000-0x00000000044D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-292-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2260-272-0x00000000044E0000-0x00000000044E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-279-0x00000000044C0000-0x00000000044C1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-281-0x0000000004410000-0x0000000004411000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-282-0x0000000004480000-0x0000000004481000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-280-0x0000000004420000-0x0000000004421000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-146-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2260-289-0x00000000002E0000-0x00000000002E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-270-0x0000000004450000-0x0000000004451000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-267-0x0000000004460000-0x0000000004461000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-147-0x00000000002E0000-0x00000000002E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-152-0x0000000004490000-0x0000000004491000-memory.dmp

                      Filesize

                      4KB

                    • memory/2260-291-0x0000000004B70000-0x0000000004F2B000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2276-792-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2324-554-0x0000000000400000-0x00000000007BB000-memory.dmp

                      Filesize

                      3.7MB