Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-02-2024 23:00

General

  • Target

    file.exe

  • Size

    317KB

  • MD5

    5352e846611bdf4ad7482d7a64445190

  • SHA1

    5d44de3ee7144a7a3566f362d277c29dee41594f

  • SHA256

    90cc438e254ee84a0362aaab2d05ca61022c2a9d855651831ea9331bdf4a54f7

  • SHA512

    120e2e381e0347fb2990d74622f2448dd88d2e27db49d18b79e17fd18604c1096f9adead0f8b5fbf35615a9829da0812dd6919a00473eee38d7227335988b3ea

  • SSDEEP

    6144:v58T0cNW9wInNW0jIyV16HTqU7ruGr3OUik7/SVYmzK:veIcNWztUqgv7hGk7/Id+

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:1764

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1764-4-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/1764-10-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/1764-12-0x0000000000E60000-0x0000000000E61000-memory.dmp

      Filesize

      4KB

    • memory/1764-13-0x0000000000E60000-0x0000000000E61000-memory.dmp

      Filesize

      4KB

    • memory/1764-11-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/1764-15-0x0000000000E60000-0x0000000000E61000-memory.dmp

      Filesize

      4KB

    • memory/1764-14-0x0000000000E60000-0x0000000000E61000-memory.dmp

      Filesize

      4KB

    • memory/1764-16-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/4496-0-0x0000000075340000-0x0000000075AF0000-memory.dmp

      Filesize

      7.7MB

    • memory/4496-1-0x0000000000FB0000-0x0000000001000000-memory.dmp

      Filesize

      320KB

    • memory/4496-7-0x00000000034A0000-0x00000000054A0000-memory.dmp

      Filesize

      32.0MB

    • memory/4496-9-0x0000000075340000-0x0000000075AF0000-memory.dmp

      Filesize

      7.7MB