Analysis

  • max time kernel
    137s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    24-02-2024 15:27

General

  • Target

    a22f400ce87664d7f5c214600509fcb3.exe

  • Size

    228KB

  • MD5

    a22f400ce87664d7f5c214600509fcb3

  • SHA1

    5a807ef099b4b71e7043d0380723becb98cb6f28

  • SHA256

    25534defb0d6daa1b4989a1aa4f4029b8333fbb31e67a90e96080bd7f365493c

  • SHA512

    874ab03464ae78e092c224c2356fbbaa15bb66e7d4fd95138ef36dcca75910aff1d80d8dcc7c01b63a493344a1b89c514e21eb6cc317541cc047293941d68d29

  • SSDEEP

    6144:OoEdkmu85Dq+3qM3W7tfQN5/inEaMadDKNa1aILk71:MkmDN6M3atfQunka1KNaTgJ

Malware Config

Signatures

  • Detect Lumma Stealer payload V4 15 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies security service 2 TTPs 20 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 20 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 11 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 32 IoCs
  • Runs .reg file with regedit 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a22f400ce87664d7f5c214600509fcb3.exe
    "C:\Users\Admin\AppData\Local\Temp\a22f400ce87664d7f5c214600509fcb3.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\acx.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Windows\SysWOW64\regedit.exe
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        3⤵
        • Modifies security service
        • Runs .reg file with regedit
        PID:2412
    • C:\Windows\SysWOW64\cPaner.com
      C:\Windows\system32\cPaner.com 508 "C:\Users\Admin\AppData\Local\Temp\a22f400ce87664d7f5c214600509fcb3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\SysWOW64\cPaner.com
        C:\Windows\system32\cPaner.com 548 "C:\Windows\SysWOW64\cPaner.com"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c c:\acx.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2116
          • C:\Windows\SysWOW64\regedit.exe
            REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
            5⤵
            • Modifies security service
            • Runs .reg file with regedit
            PID:1948
        • C:\Windows\SysWOW64\cPaner.com
          C:\Windows\system32\cPaner.com 560 "C:\Windows\SysWOW64\cPaner.com"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:1536
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c c:\acx.bat
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2460
            • C:\Windows\SysWOW64\regedit.exe
              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
              6⤵
              • Modifies security service
              • Runs .reg file with regedit
              PID:2532
          • C:\Windows\SysWOW64\cPaner.com
            C:\Windows\system32\cPaner.com 564 "C:\Windows\SysWOW64\cPaner.com"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Writes to the Master Boot Record (MBR)
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1904
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c c:\acx.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1424
              • C:\Windows\SysWOW64\regedit.exe
                REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                7⤵
                • Modifies security service
                • Runs .reg file with regedit
                PID:1920
            • C:\Windows\SysWOW64\cPaner.com
              C:\Windows\system32\cPaner.com 568 "C:\Windows\SysWOW64\cPaner.com"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes to the Master Boot Record (MBR)
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:1428
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c c:\acx.bat
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2160
                • C:\Windows\SysWOW64\regedit.exe
                  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                  8⤵
                  • Modifies security service
                  • Runs .reg file with regedit
                  PID:2144
              • C:\Windows\SysWOW64\cPaner.com
                C:\Windows\system32\cPaner.com 572 "C:\Windows\SysWOW64\cPaner.com"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Writes to the Master Boot Record (MBR)
                • Drops file in System32 directory
                PID:2688
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c c:\acx.bat
                  8⤵
                    PID:2568
                  • C:\Windows\SysWOW64\cPaner.com
                    C:\Windows\system32\cPaner.com 576 "C:\Windows\SysWOW64\cPaner.com"
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Writes to the Master Boot Record (MBR)
                    • Drops file in System32 directory
                    PID:1068
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c c:\acx.bat
                      9⤵
                        PID:2256
                        • C:\Windows\SysWOW64\regedit.exe
                          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                          10⤵
                          • Modifies security service
                          • Runs .reg file with regedit
                          PID:2360
                      • C:\Windows\SysWOW64\cPaner.com
                        C:\Windows\system32\cPaner.com 580 "C:\Windows\SysWOW64\cPaner.com"
                        9⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Writes to the Master Boot Record (MBR)
                        • Drops file in System32 directory
                        PID:2784
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c c:\acx.bat
                          10⤵
                            PID:624
                            • C:\Windows\SysWOW64\regedit.exe
                              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                              11⤵
                              • Modifies security service
                              • Runs .reg file with regedit
                              PID:1776
                          • C:\Windows\SysWOW64\cPaner.com
                            C:\Windows\system32\cPaner.com 584 "C:\Windows\SysWOW64\cPaner.com"
                            10⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Writes to the Master Boot Record (MBR)
                            • Drops file in System32 directory
                            PID:2444
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c c:\acx.bat
                              11⤵
                                PID:552
                                • C:\Windows\SysWOW64\regedit.exe
                                  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                  12⤵
                                  • Modifies security service
                                  • Runs .reg file with regedit
                                  PID:2728
                              • C:\Windows\SysWOW64\cPaner.com
                                C:\Windows\system32\cPaner.com 588 "C:\Windows\SysWOW64\cPaner.com"
                                11⤵
                                • Executes dropped EXE
                                • Writes to the Master Boot Record (MBR)
                                • Drops file in System32 directory
                                PID:1600
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c c:\acx.bat
                                  12⤵
                                    PID:760
                                    • C:\Windows\SysWOW64\regedit.exe
                                      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                      13⤵
                                      • Modifies security service
                                      • Runs .reg file with regedit
                                      PID:2116
            • C:\Windows\SysWOW64\regedit.exe
              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
              1⤵
              • Modifies security service
              • Runs .reg file with regedit
              PID:916

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\1.reg

              Filesize

              3KB

              MD5

              9e5db93bd3302c217b15561d8f1e299d

              SHA1

              95a5579b336d16213909beda75589fd0a2091f30

              SHA256

              f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

              SHA512

              b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

            • C:\acx.bat

              Filesize

              5KB

              MD5

              0019a0451cc6b9659762c3e274bc04fb

              SHA1

              5259e256cc0908f2846e532161b989f1295f479b

              SHA256

              ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

              SHA512

              314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

            • \Windows\SysWOW64\cPaner.com

              Filesize

              228KB

              MD5

              a22f400ce87664d7f5c214600509fcb3

              SHA1

              5a807ef099b4b71e7043d0380723becb98cb6f28

              SHA256

              25534defb0d6daa1b4989a1aa4f4029b8333fbb31e67a90e96080bd7f365493c

              SHA512

              874ab03464ae78e092c224c2356fbbaa15bb66e7d4fd95138ef36dcca75910aff1d80d8dcc7c01b63a493344a1b89c514e21eb6cc317541cc047293941d68d29

            • memory/1068-1189-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/1068-1052-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/1404-460-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/1428-824-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/1536-634-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/1536-512-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/1656-161-0x00000000024D0000-0x00000000024D1000-memory.dmp

              Filesize

              4KB

            • memory/1656-0-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/1656-125-0x00000000004B0000-0x00000000004B1000-memory.dmp

              Filesize

              4KB

            • memory/1656-126-0x00000000003E0000-0x00000000003E1000-memory.dmp

              Filesize

              4KB

            • memory/1656-136-0x0000000000600000-0x0000000000601000-memory.dmp

              Filesize

              4KB

            • memory/1656-166-0x0000000002960000-0x0000000002961000-memory.dmp

              Filesize

              4KB

            • memory/1656-137-0x00000000004F0000-0x00000000004F1000-memory.dmp

              Filesize

              4KB

            • memory/1656-135-0x00000000004C0000-0x00000000004C1000-memory.dmp

              Filesize

              4KB

            • memory/1656-138-0x0000000000620000-0x0000000000621000-memory.dmp

              Filesize

              4KB

            • memory/1656-139-0x0000000000610000-0x0000000000611000-memory.dmp

              Filesize

              4KB

            • memory/1656-140-0x0000000000640000-0x0000000000641000-memory.dmp

              Filesize

              4KB

            • memory/1656-142-0x0000000000660000-0x0000000000661000-memory.dmp

              Filesize

              4KB

            • memory/1656-141-0x0000000000630000-0x0000000000631000-memory.dmp

              Filesize

              4KB

            • memory/1656-143-0x0000000000650000-0x0000000000651000-memory.dmp

              Filesize

              4KB

            • memory/1656-144-0x0000000000680000-0x0000000000681000-memory.dmp

              Filesize

              4KB

            • memory/1656-145-0x0000000000670000-0x0000000000671000-memory.dmp

              Filesize

              4KB

            • memory/1656-146-0x00000000006B0000-0x00000000006B1000-memory.dmp

              Filesize

              4KB

            • memory/1656-147-0x0000000000690000-0x0000000000691000-memory.dmp

              Filesize

              4KB

            • memory/1656-148-0x0000000002010000-0x0000000002011000-memory.dmp

              Filesize

              4KB

            • memory/1656-149-0x0000000002000000-0x0000000002001000-memory.dmp

              Filesize

              4KB

            • memory/1656-150-0x0000000002030000-0x0000000002031000-memory.dmp

              Filesize

              4KB

            • memory/1656-151-0x0000000002020000-0x0000000002021000-memory.dmp

              Filesize

              4KB

            • memory/1656-152-0x0000000002050000-0x0000000002051000-memory.dmp

              Filesize

              4KB

            • memory/1656-153-0x0000000002040000-0x0000000002041000-memory.dmp

              Filesize

              4KB

            • memory/1656-154-0x0000000002070000-0x0000000002071000-memory.dmp

              Filesize

              4KB

            • memory/1656-155-0x0000000002060000-0x0000000002061000-memory.dmp

              Filesize

              4KB

            • memory/1656-156-0x0000000002090000-0x0000000002091000-memory.dmp

              Filesize

              4KB

            • memory/1656-157-0x0000000002080000-0x0000000002081000-memory.dmp

              Filesize

              4KB

            • memory/1656-158-0x00000000024C0000-0x00000000024C1000-memory.dmp

              Filesize

              4KB

            • memory/1656-159-0x00000000020A0000-0x00000000020A1000-memory.dmp

              Filesize

              4KB

            • memory/1656-160-0x00000000024E0000-0x00000000024E1000-memory.dmp

              Filesize

              4KB

            • memory/1656-122-0x00000000004A0000-0x00000000004A4000-memory.dmp

              Filesize

              16KB

            • memory/1656-162-0x0000000002500000-0x0000000002501000-memory.dmp

              Filesize

              4KB

            • memory/1656-163-0x00000000024F0000-0x00000000024F1000-memory.dmp

              Filesize

              4KB

            • memory/1656-164-0x0000000002520000-0x0000000002521000-memory.dmp

              Filesize

              4KB

            • memory/1656-165-0x0000000002510000-0x0000000002511000-memory.dmp

              Filesize

              4KB

            • memory/1656-127-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/1656-124-0x0000000000490000-0x0000000000491000-memory.dmp

              Filesize

              4KB

            • memory/1656-171-0x00000000029D0000-0x00000000029D1000-memory.dmp

              Filesize

              4KB

            • memory/1656-169-0x00000000029B0000-0x00000000029B1000-memory.dmp

              Filesize

              4KB

            • memory/1656-170-0x00000000029A0000-0x00000000029A1000-memory.dmp

              Filesize

              4KB

            • memory/1656-168-0x0000000002980000-0x0000000002981000-memory.dmp

              Filesize

              4KB

            • memory/1656-172-0x00000000029C0000-0x00000000029C1000-memory.dmp

              Filesize

              4KB

            • memory/1656-173-0x00000000029F0000-0x00000000029F1000-memory.dmp

              Filesize

              4KB

            • memory/1656-174-0x00000000029E0000-0x00000000029E1000-memory.dmp

              Filesize

              4KB

            • memory/1656-175-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

              Filesize

              4KB

            • memory/1656-176-0x0000000002A80000-0x0000000002A81000-memory.dmp

              Filesize

              4KB

            • memory/1656-177-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

              Filesize

              4KB

            • memory/1656-178-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

              Filesize

              4KB

            • memory/1656-179-0x0000000002C10000-0x0000000002C11000-memory.dmp

              Filesize

              4KB

            • memory/1656-180-0x0000000002C00000-0x0000000002C01000-memory.dmp

              Filesize

              4KB

            • memory/1656-181-0x0000000002C40000-0x0000000002C41000-memory.dmp

              Filesize

              4KB

            • memory/1656-182-0x0000000002C20000-0x0000000002C21000-memory.dmp

              Filesize

              4KB

            • memory/1656-184-0x0000000002C50000-0x0000000002C51000-memory.dmp

              Filesize

              4KB

            • memory/1656-183-0x0000000002C60000-0x0000000002C61000-memory.dmp

              Filesize

              4KB

            • memory/1656-185-0x0000000002C80000-0x0000000002C81000-memory.dmp

              Filesize

              4KB

            • memory/1656-186-0x0000000002C70000-0x0000000002C71000-memory.dmp

              Filesize

              4KB

            • memory/1656-187-0x0000000002DD0000-0x0000000002E60000-memory.dmp

              Filesize

              576KB

            • memory/1656-212-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/1656-167-0x0000000002990000-0x0000000002991000-memory.dmp

              Filesize

              4KB

            • memory/1656-1-0x00000000002F0000-0x0000000000334000-memory.dmp

              Filesize

              272KB

            • memory/1656-118-0x00000000003D0000-0x00000000003D1000-memory.dmp

              Filesize

              4KB

            • memory/1656-10-0x00000000002A0000-0x00000000002A1000-memory.dmp

              Filesize

              4KB

            • memory/1656-9-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1904-754-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/2128-341-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/2128-219-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/2128-188-0x00000000005B0000-0x00000000005B1000-memory.dmp

              Filesize

              4KB

            • memory/2444-1337-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/2444-1460-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/2688-911-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/2688-1047-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB

            • memory/2784-1195-0x0000000000400000-0x0000000000490000-memory.dmp

              Filesize

              576KB