07548b3bd8978a673ba74f5949d438685b8e569e092d057d04f305655714494b

Resubmissions

13/02/2024, 03:28

240213-d1bskshe72 7

13/02/2024, 03:26

240213-dzfp5shd54 7

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lucifer/cnc/conf.go
Size

1KB
MD5

d8f69ae164a7532531e928e2315d1118
SHA1

eda1289b8349336851fe7166b211544fabafbf40
SHA256

96f21d79d26694b9ff3dd2c15f5646220416397c9694ebf2786c2caf861a2489
SHA512

2d10dec572187d4a091b41df0cf730833c82b4e6d9c6fb314e4625cc2eb1ca4bf42d1aadb55e9fca87f4ee7556c3dd3650b5bbfa3e3772b33873dfb13dc17a9d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.go	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\go_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\go_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\go_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\go_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\go_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.go\ = "go_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\go_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2084	AcroRd32.exe
2084	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2788	2540	cmd.exe	28
PID 2540 wrote to memory of 2788	2540	cmd.exe	28
PID 2540 wrote to memory of 2788	2540	cmd.exe	28
PID 2788 wrote to memory of 2084	2788	rundll32.exe	30
PID 2788 wrote to memory of 2084	2788	rundll32.exe	30
PID 2788 wrote to memory of 2084	2788	rundll32.exe	30
PID 2788 wrote to memory of 2084	2788	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Lucifer\cnc\conf.go
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lucifer\cnc\conf.go
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lucifer\cnc\conf.go"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
276072b4dfd60114511c990ef6504e4a

SHA1
78a72df741b4f0ee920f5b2b13212416c3d5da8e

SHA256
27256ebceca41f23d2a3b70ac3723d06b2332739ae99063ed88a89053441af39

SHA512
7a7e1cd2427a0a10a447f034e7f0d7a68d44147608582e27eb20cc63edd1eff75f08795f39d0d4cc35e639007002354620c3f37e6c23f2c6bd7cce331fa6b52d

Download Submit